PUP.YAC (Yet Another Cleaner)

The detection of PUP.YAC (Yet Another Cleaner) on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take prompt action to remove it to prevent potential harm.

What Is PUP.YAC (Yet Another Cleaner)?

PUP.YAC (Yet Another Cleaner) is a type of potentially unwanted program that is designed to appear as a useful tool, but in reality, it may cause more problems than it solves. These types of programs often claim to offer benefits such as system cleaning, optimization, or protection, but they can actually compromise your system's security and stability. PUPs can be installed on your system without your knowledge or consent, often through bundled software downloads or deceptive advertising.

How PUP.YAC (Yet Another Cleaner) Operates

PUP.YAC (Yet Another Cleaner) operates by installing itself on your system and then attempting to convince you that your system is infected with various problems that only it can fix. It may display fake alerts, warnings, and scan results to create a sense of urgency and fear, prompting you to purchase a full version of the program or subscribe to its services. In reality, these warnings are often false, and the program may be creating more problems than it claims to solve. PUPs can also collect your personal data, track your browsing habits, and display unwanted advertisements, further compromising your system's security and performance.

Symptoms of Infection

If your system is infected with PUP.YAC (Yet Another Cleaner), you may experience a range of symptoms, including slow system performance, unwanted pop-ups and advertisements, and fake alerts and warnings. You may also notice that your system is configured to launch the PUP automatically, or that it is running in the background without your knowledge or consent. Additionally, you may find that your browser settings have been altered, or that you are being redirected to unwanted websites.

How to Remove PUP.YAC (Yet Another Cleaner)

1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for a more effective removal process.
2. Run a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of the PUP.
3. Uninstall any suspicious programs that may be related to the PUP, including any recently installed programs that you do not recognize or need.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions, add-ons, or settings that may have been installed by the PUP.
5. Reboot your system and run another full scan to ensure that all components of the PUP have been removed and that your system is clean.

Conclusion

Removing PUP.YAC (Yet Another Cleaner) from your system is essential to prevent potential harm and restore your system's performance and security. By following the steps outlined above, you can effectively remove this PUP and protect your system from similar threats in the future. It is also important to be cautious when downloading software and to always read the terms and conditions before installing any program. Additionally, keeping your operating system and software up to date, using strong antivirus protection, and being aware of online threats can help prevent PUPs and other types of malware from infecting your system.

Analysis Report

General information

Family Name:	PUP.YAC (Yet Another Cleaner)
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: d7c3ba6b7f1f34fd41fa1a6d50d3a996 SHA1: 6592ca274374ffaa9ff7eeb9f837ef44f3e5f14c SHA256: 49FA607289E3AD1E1289E11381A9F94ECAB899CF2C0815E11B034AB3DC5813D8 File Size: 2.00 MB, 1999600 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)

Show More

• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Elex do Brasil Participações Ltda
File Description	standard installer
File Version	1.0.107.22342
Legal Copyright	Copyright 2011-2014 Elex do Brasil Participações Ltda. All rights reserved.
Product Name	yacdl
Product Version	1.0.107.22342

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Elex do Brasil Participações Ltda	VeriSign Class 3 Code Signing 2010 CA	Self Signed

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\harddisk0\dr0	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsndc0b.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsndc0b.tmp\insertdlg.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsndc0b.tmp\insertdlg.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsndc0b.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsndc0b.tmp\system.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\~dc4b	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\~dc4b\isafedownloader.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\~dc4b\isafedownloader.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\~dc4b\nsis_setup	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\~dc4b\nsis_setup	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\~dc4b\nsis_setup_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\roaming\ecyber\log\isafedownloader.log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\ecyber\log\isafedownloader.log	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Tnztmopa\AppData\Local\Temp\nsnDC0B.tmp\insertdlg.dll	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Tnztmopa\AppData\Local\Temp\nsnDC0B.tmp\insertdlg.dll\??\C:\Users\Tnztmopa\AppData\Local\Temp\nsnDC0B.tmp\	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Shell Execute	CreateProcess
Network Winsock2	WSAStartup
User Data Access	GetComputerName GetUserName
Anti Debug	NtQuerySystemInformation
Network Wininet	HttpOpenRequest HttpQueryInfo HttpSendRequest InternetConnect InternetOpen InternetReadFile
Network Winhttp	WinHttpOpen

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Users\Tnztmopa\AppData\Local\Temp\~DC4B\iSafeDownloader.exe