PUP.Shutdowner
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Shutdowner |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
a125d5060e6b9da9af6eae6cdaf61048
SHA1:
a9c4b7aeb2ba1dcb861339962df90610084e801c
File Size:
473.60 KB, 473600 bytes
|
|
MD5:
0c7387c24e95117cd22c309861caed2b
SHA1:
4b4e0bd9c37f29587402ee7065a9aaa35fcfe6a9
SHA256:
A8813FBD369D9A91C0DB1D7F284127A662DA0D5D25AABA76DA4DF08436BAFF03
File Size:
262.14 KB, 262144 bytes
|
|
MD5:
c763c5574f47938269cdeae1bea3d11d
SHA1:
8960a25ce93bf53aa0558d1f008a72477524261a
SHA256:
28D5DBAF7A21C0038BFC53513666C96432C38FB42B9DB2DD8EE2B49230D79EF9
File Size:
1.01 MB, 1006975 bytes
|
|
MD5:
98deffb8e41a1e43c40ba3420ffe13c1
SHA1:
40edcffccd95dc6f8f7e49e379fa73db59cb2467
SHA256:
9A7BDC5F6673E7D9CB6417424CB1AFFDE1268EF3258FA09B545637A30370E820
File Size:
2.36 MB, 2364760 bytes
|
|
MD5:
87a7699514b0fda8c306017850e24129
SHA1:
16753227297a9b8c5f2d3c46d15e9078962d5898
SHA256:
4D5EABE85314668A06AD890A09576602B2D0FE18E81AB6240B5E551EC244ECA1
File Size:
1.67 MB, 1671168 bytes
|
Show More
|
MD5:
44ec596e6e114a4261dc964e94065afc
SHA1:
13b2558024c8200de3173bc7daaac21b672d32b6
SHA256:
0A697E6E3660D59DDD861B3C589C6651AF8E1D8CFBF7AA6D8446F681633C108F
File Size:
1.65 MB, 1650181 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | This installation was built with Inno Setup. |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- HighEntropy
- packed
- vb6
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.EDA
- IEHelper.B
- Lamer.CF
- Stealer.BBA
- Wapomi.F
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| c:\program files (x86)\bruteremoval | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\__tmp_rar_sfx_access_check_2926890 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\allow.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\allow.ini | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\autoruns.chm | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\autoruns.chm | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\autoruns.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\autoruns.exe | Synchronize,Write Attributes |
Show More
| c:\program files (x86)\bruteremoval\autorunsc.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\autorunsc.exe | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\bruteremoval.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\bruteremoval.exe | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\fix.cmd | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\fix.cmd | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\fixproblems.reg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\fixproblems.reg | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\mscomctl.ocx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\mscomctl.ocx | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\mscomctl32.ocx | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\mscomctl32.ocx | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\msvbvm60.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\msvbvm60.dll | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\nircmd.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\nircmd.exe | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\removeknown.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\removeknown.bat | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\repairs.vbs | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\repairs.vbs | Synchronize,Write Attributes |
| c:\program files (x86)\bruteremoval\restart.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\bruteremoval\restart.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\~dffa6bbf7858d8e3b1.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix | Generic Write,Read Attributes |
| c:\users\user\downloads\smitfraudfix | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\dumphive.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\dumphive.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\exit.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\exit.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\genericrenosfix.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\genericrenosfix.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\getpaths.vbs | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\getpaths.vbs | Generic Write,Read Attributes |
| c:\users\user\downloads\smitfraudfix\hostschk.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\hostschk.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\process.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\process.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\reboot.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\reboot.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\restart.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\restart.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\smitfraudfix.cmd | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\smitfraudfix.cmd | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\smiupdate.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\smiupdate.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\srchsts.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\srchsts.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\swreg.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\swreg.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\swsc.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\swsc.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\swxcacls.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\swxcacls.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\unzip.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\unzip.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\smitfraudfix\vcclsid.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\smitfraudfix\vcclsid.exe | Synchronize,Write Attributes |
| c:\windows\syswow64\dumphive.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\windows\syswow64\dumphive.exe | Synchronize,Write Attributes |
| c:\windows\syswow64\process.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\windows\syswow64\process.exe | Synchronize,Write Attributes |
| c:\windows\syswow64\srchsts.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\windows\syswow64\srchsts.exe | Synchronize,Write Attributes |
| c:\windows\syswow64\swreg.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\windows\syswow64\swreg.exe | Synchronize,Write Attributes |
| c:\windows\syswow64\swsc.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\windows\syswow64\swsc.exe | Synchronize,Write Attributes |
| c:\windows\syswow64\swxcacls.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\windows\syswow64\swxcacls.exe | Synchronize,Write Attributes |
| c:\windows\syswow64\vcclsid.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\windows\syswow64\vcclsid.exe | Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 桨熪ೂǜ | RegNtPreCreateKey |
| HKCU\software\winrar sfx::c%%program files (x86)%bruteremoval | C:\Program Files (x86)\BruteRemoval | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Other Suspicious |
|
| Keyboard Access |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Syscall Use |
Show More
99 additional items are not displayed above. |
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
(NULL) C:\WINDOWS\system32\cmd.exe /c cd SmitfraudFix && SmitfraudFix.cmd
|
C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /S /D /c" VER"
|
C:\WINDOWS\system32\find.exe find "Windows 95"
|
C:\WINDOWS\system32\find.exe find "Windows 98"
|
C:\WINDOWS\system32\find.exe find "Windows Millennium"
|
Show More
C:\WINDOWS\system32\find.exe find "Windows XP"
|
C:\WINDOWS\system32\find.exe find "Windows 2000"
|
C:\WINDOWS\system32\find.exe find "Version 5.2.3790"
|
C:\WINDOWS\system32\find.exe find "Version 6.0"
|
C:\WINDOWS\system32\find.exe find "version 6.0"
|
C:\WINDOWS\system32\cscript.exe cscript //I //nologo GetPaths.vbs
|
WriteConsole: CScript Error: C
|
WriteConsole: 'SetPaths.bat' i
|
WriteConsole: Could Not Find c
|
WriteConsole: 'chkntfs' is not
|
