Trojan.Downloader.Adload

The detection of Trojan.Downloader.Adload on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to download and install additional malicious software on your computer, which can lead to a range of problems, including data theft, system crashes, and unauthorized access to your personal information.

What Is Trojan.Downloader.Adload?

Trojan.Downloader.Adload is a type of Trojan horse malware that is designed to download and install additional malicious software on your computer. The name "Trojan" refers to the fact that this type of malware disguises itself as legitimate software, allowing it to evade detection and gain access to your system. The "Downloader" part of the name indicates that this malware is capable of downloading and installing additional malware components from the internet.

How Trojan.Downloader.Adload Operates

Trojan.Downloader.Adload typically operates by exploiting vulnerabilities in your system or by tricking you into installing it voluntarily. Once installed, it can download and install additional malware components, such as adware, spyware, or ransomware. This can lead to a range of problems, including pop-up ads, system crashes, and data theft. The malware may also communicate with its creators, allowing them to remotely control your system and steal your personal information.

Symptoms of Infection

The symptoms of a Trojan.Downloader.Adload infection can vary, but common signs include slow system performance, pop-up ads, and unfamiliar programs or icons on your desktop. You may also notice that your system is crashing frequently or that your personal information is being stolen. In some cases, the malware may not exhibit any noticeable symptoms, making it difficult to detect without the use of specialized software.

• Slow system performance
• Pop-up ads
• Unfamiliar programs or icons on your desktop
• Frequent system crashes
• Theft of personal information

How to Remove Trojan.Downloader.Adload

1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow you to download and install removal tools.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove the malware.
3. Uninstall any suspicious programs or applications that may be related to the malware.
4. Reset your web browsers, such as Chrome, Firefox, or Edge, to their default settings to remove any malicious extensions or add-ons.
5. Reboot your system and perform another full scan to ensure that the malware has been completely removed.

Conclusion

Removing Trojan.Downloader.Adload from your system requires careful attention to detail and the use of specialized software. By following the steps outlined above, you can help to ensure that your system is safe and secure. It's also important to take steps to prevent future infections, such as keeping your operating system and software up to date, using strong antivirus software, and being cautious when downloading and installing software from the internet. Remember to always be vigilant and to monitor your system for any signs of malware activity.

Analysis Report

General information

Family Name:	Trojan.Downloader.Adload
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 93721e4a47e48213fc493b56df47f1bd SHA1: b51632b2be5adfe825cce1a34bc9d96d4b4dc92d File Size: 843.23 KB, 843232 bytes

MD5: 7f9b9704f2e1894881c3dc42266bdf0a SHA1: 27ab461936e95ad714bdce8043287dcf103a6e5d File Size: 1.44 MB, 1436119 bytes

MD5: 7486e0fb9444e3a5e4e5bee96ad77e29 SHA1: 7d4ae27d88677d3b659f0ebe46ce2299fa483e51 File Size: 827.45 KB, 827448 bytes

MD5: fae472eea8dd4a713e4b113808526b78 SHA1: 48dc296d3112bf47db725bc4588234f6352bd7c4 SHA256: 7ED7D233BBC68C942A4E3014724FB2D602F4E596694B34972C927F455AFAE7E6 File Size: 826.66 KB, 826664 bytes

MD5: 1dd2a9355fdf04e0bf5d1cba874195d9 SHA1: 16a0c5195bb92d92e0c0d1e546deb8dd9a00fb37 SHA256: 757D27551C9B37484DD3ABD94A41A2DF1AEF470D255284E497B9478B9D84C4F8 File Size: 6.28 MB, 6276456 bytes

Show More

MD5: f11e94ff029e5e2c2538c78a8de2a9ee SHA1: 8a4803423745164dd24967bf836a2dd45c3779c1 SHA256: BD6E0986D46ED3CEB19D11BB7A54FDA5F1B418C90AC8BFFEF69FE74B08E7D16D File Size: 902.94 KB, 902936 bytes

MD5: da7249b7fa15fd46e5dc71646f78b736 SHA1: f706d3e5c8d7ce1d8828e4effb0f0b39874f70d3 SHA256: 09B48A2338DBC87CDB65A88965F4A38F689AA43C52F30710DC484BF928873F79 File Size: 1.73 MB, 1726944 bytes

MD5: c9412d8904f5e266a2a3cfdeb2fb1f4a SHA1: 7b423b2d7b94856b2cd411c474e992e4cb4ecb46 SHA256: 59D4DD06333AEB7F5A1B457D0AF23949A4EA4B199DE3F23754802F26CFF30232 File Size: 379.14 KB, 379138 bytes

MD5: 92d0ad2f73392547b31c32da2dcc553c SHA1: 364a8bc0f32fcc9ce76683502ddd2fee4d294937 SHA256: E77F75669E4B6F89ED073B6F00A8D55CC196C2E441C7CFD010CE9EE11EBC5960 File Size: 120.97 KB, 120974 bytes

MD5: 128d9d5654c09e819cb55c710f30fb2b SHA1: e098102a7b33e3d2ad7075affa00603258a85ef3 SHA256: A7D3EB7B49D560D82A956067B1A005C26F61098120F636BEDD9AA2F9996ECB23 File Size: 839.74 KB, 839744 bytes

MD5: bea2ce574916414a23e3ce0c06b4ce42 SHA1: 90e71ed4cc8b6b97a7df7693866949e481ae059a SHA256: 6579A6106438632C473CEF4968A287C32750739685087756CC054C2CD11B5C07 File Size: 88.70 KB, 88696 bytes

MD5: c58193435f85bcd9115f59ae2d324891 SHA1: 467592a403fec957e33c47449cdf77373758b506 SHA256: C81C3D557219A3486C1A3AEFFDCA11B485B51548461504730DC0BB40398CCAF0 File Size: 890.14 KB, 890144 bytes

MD5: aaca40daf744e9b9312d375ce3990bad SHA1: 4f4935b2a6c195a5334054447a2ab733cd2a8088 SHA256: 7E9C1BFE1DA56C84C872144E7FC6FE7702647E247489B5D43A4F13DF6501D94D File Size: 731.42 KB, 731416 bytes

MD5: 40af57fbc53b2bb9cd62ff65ed62bbdd SHA1: cb4cff53a7bfbfaada70ca51fd006619656a17fb SHA256: 8BB150F9B5F00B79FA7389C91DA19F98E4CA03F8D0718DC1E1480595DBDD863D File Size: 3.67 MB, 3672245 bytes

MD5: 574345746cc7605871fddebda4cae3d2 SHA1: 79b5446e6d458efd8d1715cbfccc81dcff337dc3 SHA256: 87073AF8828A7B5667C05D74C6D7D740049597707C74691874DB5CDC862BA34F File Size: 1.73 MB, 1726357 bytes

MD5: 9728984d3c4407fd9d66f3b5e01b1916 SHA1: 0767fb251ed216d275e66854bdc7f4ef8d6b2ce3 SHA256: DCEBE48D04748C3D6890FD24E19141BD191640C0504F3E75946096F1E013840A File Size: 397.01 KB, 397010 bytes

MD5: 197e6f954d815eeb08b34f95883bb9f0 SHA1: 6e39bd630d481af6206081406c2ae20dec96d2cd SHA256: F496FEA4A3580474899E8CEDEF79AA0BB69B7C35996278233FC7EA0B3A37C6BC File Size: 901.26 KB, 901256 bytes

MD5: c9f4c38955d09e0f61b5c09b93d8ac67 SHA1: 5e68a031a799fdb770a0ce566b7d54448b7f03a8 SHA256: 9237C837B2F66155EC771CD1AAF5C92DF2BAA636B60747A9598D51F89071D5A8 File Size: 2.36 MB, 2364457 bytes

MD5: c8e6a56110add6507dcb839b19080768 SHA1: 4e7d7f4106be41f5d62631cf41896b7257d1b726 SHA256: D20E827647788CB4FF03852A2AAAD2CF1F8659846424FD03BC35CB6A90091CBB File Size: 123.46 KB, 123462 bytes

MD5: b210dce13f6f4417cabfd35d71cb874b SHA1: 3dd4e095aaaa6381b120b29f4d830030c8def181 SHA256: 9D809A4A32A49476A0E92785CE218A3B4CCBA40574230C1F964C861539DADD69 File Size: 1.00 MB, 1003904 bytes

MD5: 3fe78fe8d4001048779353ad0829f6f4 SHA1: 4db5ca05fec2f27dc7c96bbaa416ef60c281d3cd SHA256: 5FC2E98AD7B8C2FD3BF533D363D8134D80611EA663A4A2FFECB1F2305044AEAB File Size: 843.24 KB, 843240 bytes

MD5: bc84539508102516bef363327789e47e SHA1: e977bd94cdbc95c7c106b40ade2b5a3ab8d1c9c8 SHA256: AADA7664F8FC0460F5C7D035E36ADB021AA515CDEF303EF4D86644977CF64FB0 File Size: 62.88 KB, 62882 bytes

MD5: 2bbd831e00663109fc8db48d504cf26c SHA1: b607fedd9a197fff5fd508f983032e267e9d44bd SHA256: CE9C4861E176C15306891FF4EE4D5B5C5490CC040DD023E9173A9B7F53E9AD3D File Size: 397.44 KB, 397436 bytes

MD5: e71e9c2fb646868c4c77d6ce080998e0 SHA1: ef677ed29f2589ccc5e46891f8a65bfed6ac81b6 SHA256: 0DB7CD29DED02BCD5EB7DE5A2EA528A43253EE0F2CB33FB8D77A55F3E6DE547A File Size: 898.50 KB, 898504 bytes

MD5: 120e8ac461cd69b914c740c34be95065 SHA1: b10efc286e2e647a55c31c52eefb41465a46ac09 SHA256: 6D28DC3AF9216D55B51A736AD54777A924E2CC7B60365788C297751AF33288D3 File Size: 4.03 MB, 4027200 bytes

MD5: e3c9c777f66ecb8d6d1dbca40da26576 SHA1: e6efe90e9a604b1d6876d0bb0f875e4e7afbeaa8 SHA256: 21B49E5B9CD5168A74C0D0FCB23EE3A4E784A13B979C68F46598D59A5BA12D51 File Size: 898.88 KB, 898880 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Show More

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	Probit Software LTD PSafe S/A Smilebox, Inc.
File Description	Easy Driver Pro Instalador do PSafe Instalador do PSafe (Canal:2) Kiwi X Executor.exe Setup Smilebox Installer
File Version	8.2.0.7 6.5.0.0 3.2.1210.1401 3.1.1209.17401 1.10814.11423.11239 1.0.0.32697 1.0.0.32269 1.0.0.31898 1.0.0.31813 1.0.0.31210 Show More 1.0.0.29190
Legal Copyright	(C) 081414231239 (c) 2011 Smilebox, Inc. All Rights Reserved Kiwi X Executor.exe Probit Software LTD © PSafe S/A
Product Name	Easy Driver Pro Kiwi X Executor.exe PSafe Smilebox
Product Version	8.2.0 6.5.0.0 3.2.1210.1401 3.1.1209.17401 1.10814.11423.11239

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
SANDREANO PAULA SILVA	AddTrust External CA Root	Root Not Trusted
PSafe Tecnologia S.A.	DigiCert Assured ID Code Signing CA-1	Self Signed
Smilebox, Inc.	Symantec Class 3 SHA256 Code Signing CA	Self Signed

File Traits

• 2+ executable sections
• Inno
• InnoSetup Installer
• Installer Manifest
• Installer Version
• VirtualQueryEx
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Agent.M
• Agent.MH
• Agent.MI
• Agent.MU
• Autorun.LA

Show More

• FakeAV.AU

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe	Generic Read,Write Attributes
\device\namedpipe	Generic Write,Read Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\binsischeck654.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-113p5.tmp\79b5446e6d458efd8d1715cbfccc81dcff337dc3_0001726357.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-8t6j8.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-8t6j8.tmp\idp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-sq7lc.tmp\f706d3e5c8d7ce1d8828e4effb0f0b39874f70d3_0001726944.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-uupi9.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-uupi9.tmp\idp.dll	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\nsa4cca.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsa6200.tmp\installsplash.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsa6200.tmp\installsplash.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa6200.tmp\installsplash.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsa6200.tmp\installsplash.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa6200.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb2c29.tmp\installsplash.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsb2c29.tmp\installsplash.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb2c29.tmp\installsplash.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsb2c29.tmp\installsplash.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb2c29.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsd6d81.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nse48fc.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsee0fb.tmp\ipconfig.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsee0fb.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsf4b6d.tmp\banner.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsf4b6d.tmp\inetc.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsf4b6d.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsf4b6d.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsf4b6d.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsf4b6d.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsf4b6d.tmp\xml.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsha6cb.tmp\installsplash.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsha6cb.tmp\installsplash.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsha6cb.tmp\installsplash.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsha6cb.tmp\installsplash.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsha6cb.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsi6da1.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsi6da1.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsi6da1.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsi6da1.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsi6da1.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk4772.tmp\installsplash.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsk4772.tmp\installsplash.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk4772.tmp\installsplash.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsk4772.tmp\installsplash.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk4772.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nskfc60.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nskfcaf.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nskfcaf.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nskfcaf.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nskfcaf.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsl3f07.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsl3f07.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsl3f07.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsl3f07.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nslbd4b.tmp\langdll.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nslbd4b.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nslbd4b.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nslbd4b.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nslbd4b.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nslbd4b.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm514e.tmp\installsplash.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsm514e.tmp\installsplash.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm514e.tmp\installsplash.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsm514e.tmp\installsplash.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm514e.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm81d0.tmp\installsplash.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsm81d0.tmp\installsplash.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm81d0.tmp\installsplash.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsm81d0.tmp\installsplash.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm81d0.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp4cda.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp4cda.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp4cda.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsp4cda.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp4cda.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp4cda.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsre950.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsre950.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsre950.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsre950.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsre950.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssa7a6.tmp\nsexec.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssa7a6.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsub49a.tmp\langdll.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsv3de1.tmp\banner.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsv3de1.tmp\inetc.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsv3de1.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsv3de1.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsv3de1.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsv3de1.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsv3de1.tmp\xml.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsvb25d.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsvb26d.tmp\banner.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsvb26d.tmp\config.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsvb26d.tmp\inetc.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsvb26d.tmp\logo.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsvb26d.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsvb26d.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsvb26d.tmp\payloadreader.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsvb26d.tmp\smsplus.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsvb26d.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nswe920.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsz3271.tmp\installsplash.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsz3271.tmp\installsplash.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz3271.tmp\installsplash.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsz3271.tmp\installsplash.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz3271.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz49c8.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\8b2b9a00839eed1dfdccc3bfc2f5df12	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b46811c17859ffb409cf0e904a4aa8f8	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8b2b9a00839eed1dfdccc3bfc2f5df12	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b46811c17859ffb409cf0e904a4aa8f8	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix	Cookie:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix	Visited:	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	窌倧闣ǜ	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Keyboard Access	GetKeyState
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Network Wininet	HttpOpenRequest HttpQueryInfo HttpSendRequest InternetConnect InternetOpen InternetQueryOption InternetReadFile
Process Shell Execute	CreateProcess
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection Show More ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Other Suspicious	AdjustTokenPrivileges
Process Terminate	TerminateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Xzlsaarx\AppData\Local\Temp\is-SQ7LC.tmp\f706d3e5c8d7ce1d8828e4effb0f0b39874f70d3_0001726944.tmp" /SL5="$20138,865850,776192,c:\users\user\downloads\f706d3e5c8d7ce1d8828e4effb0f0b39874f70d3_0001726944"

"C:\Users\Tctjzqsg\AppData\Local\Temp\is-113P5.tmp\79b5446e6d458efd8d1715cbfccc81dcff337dc3_0001726357.tmp" /SL5="$701FA,865850,776192,c:\users\user\downloads\79b5446e6d458efd8d1715cbfccc81dcff337dc3_0001726357"

taskkill /f /im rkverify.exe