Trojan.Installmonstr

The detection of Trojan.Installmonstr on your system indicates a potential security threat that requires immediate attention. Trojan horses, like the detected Trojan.Installmonstr, are malicious programs designed to infiltrate and compromise computer systems. Understanding the nature and behavior of this threat is crucial for effective removal and prevention of future infections.

What Is Trojan.Installmonstr?

Trojan horses are a type of malware that disguises itself as legitimate software, allowing it to evade detection and gain unauthorized access to a computer system. The name Trojan.Installmonstr suggests it may be related to installing or downloading malicious components, but without specific details, it's essential to approach removal with a general understanding of Trojan horse behavior. These threats can lead to a variety of malicious activities, including data theft, system compromise, and the installation of additional malware.

How Trojan.Installmonstr Operates

Typically, Trojan horses operate by exploiting vulnerabilities in software or human behavior. They can be distributed through various means, including email attachments, infected software downloads, or compromised websites. Once installed, a Trojan horse can create backdoors for remote access, allowing attackers to control the infected system, steal sensitive information, or use the system for malicious purposes such as spamming or launching attacks on other systems. The specific operations of Trojan.Installmonstr would depend on its design and the intentions of its creators, but the general approach to mitigation remains consistent with other Trojan infections.

Symptoms of Infection

Symptoms of a Trojan horse infection can vary widely, depending on the malware's purpose and design. Common indicators include unexpected system behavior, such as unusual pop-ups, slow system performance, or unfamiliar programs appearing in the system tray or task manager. Sometimes, infections may not exhibit obvious symptoms, making regular system monitoring and antivirus scans crucial for early detection. The presence of Trojan.Installmonstr may or may not be accompanied by noticeable system changes, highlighting the importance of proactive security measures.

How to Remove Trojan.Installmonstr

1. Boot your system into Safe Mode with Networking to limit the malware's ability to interfere with the removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all traces of the malware.
3. Uninstall any suspicious programs that were installed around the time of the infection. Be cautious and only remove programs you are certain are malicious or unnecessary.
4. Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any malicious extensions or settings changes made by the Trojan.
5. Reboot your system and perform another full scan to ensure that all components of the malware have been removed. Repeat this process until no more threats are detected.

Conclusion

Removing Trojan.Installmonstr from your system requires a combination of the right tools and careful procedure. By understanding how Trojan horses operate and following a systematic approach to removal, you can effectively eliminate the threat and protect your system from future infections. Regular system updates, use of reputable antivirus software, and cautious behavior online (avoiding suspicious downloads and email attachments) are key to preventing Trojan horse infections. If you are unsure about any part of the removal process, consider seeking help from a professional to ensure your system is thoroughly cleaned and secured.

SpyHunter Detects & Remove Trojan.Installmonstr

Analysis Report

General information

Family Name:	Trojan.Installmonstr
Signature status:	Root Not Trusted

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 74bd5fa0652cedaa90984335d570e941 SHA1: ce736c6d8d9bf44a34cbb2c41960e40dc2d4cf71 SHA256: 80E9726CB733E2660828C416729AB445E0BA55B7024FF16CA892FB6A25C3E3CF File Size: 3.19 MB, 3188168 bytes

MD5: 970befb365c781f59c5308e67aaa2e6a SHA1: 726906787c7a2bb35ffe6d3605eba9f1eb43a544 SHA256: 52E1E306BC39EEB05F3C3C94E26C88B901B21E258574244FA2345B4A77BBA2F4 File Size: 1.28 MB, 1281680 bytes

MD5: 2a95d3d07ae8daf422f556cbd4293709 SHA1: 190814ef71d2648798f4ad51051411581df97a7c SHA256: 60F9D05B2086AF66ADF567B218B6EB16B06D01AC01514C5977C9C918B0BFC140 File Size: 4.80 MB, 4797128 bytes

MD5: e81020fd54ed7561a4a907087b3696b0 SHA1: 8a7e79e584379d0e92348888c037774ce8456ab3 SHA256: 7042CE486BDCE02DB99C08B19FFFC6AF3AA25541C239C58F387D73D07C949E72 File Size: 537.02 KB, 537024 bytes

MD5: 3003e8f1ea15d2b91905a001ce628159 SHA1: a8541bee57c20f690f560ddcaa18a7ccd9011aa0 SHA256: B3A4648059688AD1EBC31AAC116BFF1800E5B031BCFA99F08965CE945CB27A31 File Size: 4.59 MB, 4586664 bytes

Show More

MD5: 271a46c931f42f5c1d01941677ca65af SHA1: 991affa76bb2f620c120fb4df973e2a72d541fed SHA256: BBFC55D43959B60ADF7C66915ECBB475A81AF7ED697AD672EA301EEEBF554FA9 File Size: 3.96 MB, 3955288 bytes

MD5: 206fa860356a5393b2f8172e034acede SHA1: 8112336f8d1a1d67265f6f08274bfae338bccebf SHA256: D36DD719F728B440D0DAE226C58C51E1576D9CC5EBD42C82BB4FACEA7E146C4A File Size: 366.89 KB, 366888 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has been packed
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	260.0.0.0 This installation was built with Inno Setup.
Company Name	Allmyapps Allmyapps SAS Lobanebec Soft company Software company
File Description	Allmyapps AppsWatcher Description Fastest file downloader Tesabi Setup
File Version	172.3.4.6627 4.2.3.2 4.2.1.2 2.0.0.30 2.0.0.8 1.5.3.1 1.0.0.0
Internal Name	Application downloader GetApplication SfxSetup.exe
Legal Copyright	All copyright Copyright Copyright (C) 2011 Internet file x1LegalCopyright
Legal Trademarks	c2LegalTrademarks Trademark A Trademarks
Original Filename	SfxSetup.exe v3OriginalFilename
Product Name	Allmyapps AppsWatcher b4ProductName Product1 ProductNames Tesabi
Product Version	350.0.0.0 4.6 2.3.1 2.2.1.83 2.0.0.30 2.0.0.8 1.0.0.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Bastion Develop, TOV	COMODO RSA Code Signing CA	Self Signed
INFOKINETIKA	COMODO RSA Code Signing CA	Self Signed
LLC KOLORIS IT	COMODO RSA Code Signing CA	Self Signed
Smart Solyushns Kompani, TOV	COMODO RSA Code Signing CA	Self Signed
Velko Smart, TOV	COMODO RSA Code Signing CA	Self Signed

Show More

ALLMYAPPS

thawte Primary Root CA

Root Not Trusted

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Agent.DSS
• Delf.FC
• Delf.OF
• InstallMonstr.B
• Lumma.SB

Show More

• Ulise.BE
• Vadokrist.B

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\bd69.tmp\appswatcher.bat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\programdata\appswatcher\appswatcher.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7z0efdf28c\setup_appswatcher_0_1.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7z0efdf28c\setup_appswatcher_0_1.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7z6fffc428\setup.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7z6fffc428\setup.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ama43229.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-vr2av.tmp\726906787c7a2bb35ffe6d3605eba9f1eb43a544_0001281680.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsjef75.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsjef76.tmp	Synchronize,Write Attributes

Show More

c:\users\user\appdata\local\temp\nsjef76.tmp\dialer.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\dialer.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\inetc.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\inetc.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\newadvsplash.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\newadvsplash.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\registry.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\registry.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\splash-screen.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\splash-screen.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsjef76.tmp\system.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nspbabb.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsubacb.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\dialer.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\dialer.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\dummy.htm	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\dummy.htm	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\dummy.htm_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\inetc.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\inetc.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\newadvsplash.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\newadvsplash.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\registry.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\registry.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\splash-screen.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\splash-screen.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsubacb.tmp\system.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\~df038abbec56328ff0.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\~df6c69e9172441289b.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\allmyapps\infos.json	Generic Write,Read Attributes
c:\users\user\appdata\roaming\appswatcher\infos.json	Generic Write,Read Attributes
c:\users\user\downloads\190814ef71d2648798f4ad51051411581df97a7c_0004797128	Generic Write,Read Attributes
c:\users\user\downloads\a8541bee57c20f690f560ddcaa18a7ccd9011aa0_0004586664	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Yqwusbhc\AppData\Local\Temp\nsjEF76.tmp\newadvsplash.dll	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Yqwusbhc\AppData\Local\Temp\nsjEF76.tmp\newadvsplash.dll\??\C:\Users\Yqwusbhc\AppData\Local\Temp\nsjEF76.tmp\regi	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	1y   xykP~ �ރ��� l ��^۴� }��Vs}kP~��1 %�� ���dB F e�k��1:�� h �n� }e�� e��	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	႔풉ꢢǜ	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	�   xy * � /�� Y� d� kP~ � � �ރ �p��^ �o � ee 3Vs}kP~��1.�� 7 � �� ﺃee�� � ��1 �� fe�� g �	RegNtPreCreateKey

Show More

HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75

�j �8��8 1��B �6 �v y��Z xy �� �a ۀ T�B������1�����5����ee Bx�< �����R �7 �!wz"M)"Wc#�#�� $kF $��%"�%:�%� &� &�x'�(�(X�)�`*J*9 *�^ +�[+��,=�,��/9�/��1`1�

RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetUserObjectInformation OpenClipboard
Keyboard Access	GetKeyboardState
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess ShellExecute ShellExecuteEx
Network Winsock2	WSAStartup WSAttemptAutodialName
Network Winsock	bind closesocket getaddrinfo getsockname setsockopt socket
Network Winhttp	WinHttpOpen
Network Wininet	HttpOpenRequest HttpQueryInfo HttpSendRequest InternetConnect InternetOpen InternetQueryOption InternetReadFile
Syscall Use	ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject Show More ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenSection ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Wfyvwmlp\AppData\Local\Temp\is-VR2AV.tmp\726906787c7a2bb35ffe6d3605eba9f1eb43a544_0001281680.tmp" /SL5="$2013E,1027327,56832,c:\users\user\downloads\726906787c7a2bb35ffe6d3605eba9f1eb43a544_0001281680"

(NULL) C:\Users\Yqwusbhc\AppData\Local\Temp\7z6FFFC428\Setup.exe ama:install:b56354872ad1648e2c0892e5be370699ot

(NULL) C:\Users\Rzjzpsxd\AppData\Local\Temp\7z0EFDF28C\Setup_AppsWatcher_0_1.exe ama:install:a033e08f5ad99a58874de58249411555ot

runas C:\Users\Rzjzpsxd\AppData\Local\Temp\ama43229.exe

open \BD69.tmp\appswatcher.bat