PUP.Gemius

The detection of PUP.Gemius on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take immediate action to remove it to prevent any potential harm.

What Is PUP.Gemius?

PUP.Gemius is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as destructive as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your personal data. PUPs are often installed unintentionally, and they can be difficult to remove without the right tools and expertise.

How PUP.Gemius Operates

PUP.Gemius, like other PUPs, can operate in various ways to achieve its goals. It may be designed to display unwanted advertisements, collect user data, or install additional malware on the affected system. In some cases, PUPs can also modify system settings, slow down the computer, or cause other issues that can be frustrating for the user. The exact behavior of PUP.Gemius can vary, but its primary goal is often to generate revenue for its creators or to compromise the user's system for malicious purposes.

Symptoms of Infection

Identifying the symptoms of a PUP.Gemius infection can be challenging, as they can be similar to those caused by other types of malware. However, some common signs include unexpected pop-ups or advertisements, slower system performance, and unfamiliar programs or icons on the desktop. Users may also notice that their browser settings have been changed or that they are being redirected to unwanted websites. If you have noticed any of these symptoms, it is crucial to take action to remove the PUP and protect your system.

• Unwanted advertisements or pop-ups
• Slower system performance
• Unfamiliar programs or icons on the desktop
• Changed browser settings
• Redirects to unwanted websites

How to Remove PUP.Gemius

1. Boot your computer in Safe Mode with Networking to prevent the PUP from loading and to allow for a more effective removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malware, including PUP.Gemius.
3. Uninstall any suspicious programs or applications that you do not recognize or that were installed without your consent.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions or add-ons.
5. Reboot your computer and perform another scan with your anti-malware tool to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.Gemius from your system is crucial to prevent any potential harm and to restore your computer's performance and security. By following the steps outlined above and using a reputable anti-malware tool, you can effectively remove this PUP and protect your system from similar threats in the future. It is also essential to practice safe computing habits, such as avoiding suspicious downloads and being cautious when clicking on links or advertisements, to reduce the risk of infection. Remember, staying vigilant and taking proactive measures is key to maintaining the security and integrity of your computer system.

Analysis Report

General information

Family Name:	PUP.Gemius
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: ba7731114014d787661bad0353c3e8f4 SHA1: b046b27a65faa3bc4e96b80d0b5135acdcfd5177 SHA256: F1023D708D0024F55FE82B1A3BB613EF3B38EFF6AD848862E595E3437AD20B6A File Size: 2.69 MB, 2692104 bytes

MD5: 457d42acf3a0893f73da71a25f931ab5 SHA1: 627d8a34765ca440e60d32207773a401dd19106c SHA256: 3EF8009AB459B3C7A38A3D361C765D55291DDB1A8DA3BD475FEC37E481908253 File Size: 2.72 MB, 2722736 bytes

MD5: ef23046dc8c44d2199691eb95edbbc94 SHA1: 564d2cf896cf0841e2c31dd7f029aef46ebc9bbc SHA256: 49D6E1D83C017A858FA0CC4B9377588F9EEB0477143B2C987C8ACD8276A20B70 File Size: 2.40 MB, 2402104 bytes

MD5: 4aed1e2f09acd403b67d3fa3f95a272c SHA1: f77e2ebbeb9c406e4be928eb9548d2baeb68dff6 SHA256: 1C6EC2ED7F2B5D2CCBC45629AB41EAECCF8256549CFFC50B71BAA9D38650094D File Size: 2.70 MB, 2699048 bytes

MD5: 8e7a2382a12117b39f07e38c7a80350e SHA1: 428c1790933eeb076ca6363259226dd3618ac59f SHA256: D68F0E306BA9F577A6663BC579D4BA2D11CB0682B32D2E40B689638ABE07B8F5 File Size: 2.69 MB, 2693232 bytes

Show More

MD5: 8aa99cf2753866823b8dda3d47e86c0e SHA1: 17627b2bc3d20975d1dabfcf3c2c7bd0235fe515 SHA256: 2BB840CD95A61AAAAB7D59B9D8E2D9082A71C753C1C51A18BA0665F7BB82F85E File Size: 2.66 MB, 2662136 bytes

MD5: d28dc2ead4975023b27ab5ff222976a3 SHA1: 4f38c6e9daf18cd4cb6e1e9f1cd12d858f472abb SHA256: DA61630706B6334594C6C96FD28457BA7509EBCE83B2728AA4A655FFA325259C File Size: 2.69 MB, 2692888 bytes

MD5: eef1a4fc6a23270e6c3b81db0adcba0f SHA1: da463156468080c04c2ecc1bb0ea649a980c3693 SHA256: 0F6F21AFEAA19D30E75F1B6774A1F1A15567496F829EBDF05BD404D91579A1EA File Size: 306.67 KB, 306672 bytes

MD5: 6f8cf12516a5d855fcb6f180fddb31d8 SHA1: 52cbc3fc710225311bbf69f453918001477f1320 SHA256: 651B0F6B688B21AF07477A3EA40BDAB094554008092F5E1B2F60380F2B6FE3DA File Size: 543.42 KB, 543416 bytes

MD5: 9cdf44db9a743e207060dbfabd8ac758 SHA1: 421d43fa911ac235ef99d8b0a6686bb10784e43e SHA256: A2B9C1C2DAC3210A9A1A989E54D3F34B0DB2957E3C6E072E43F83F69A3B52751 File Size: 2.66 MB, 2662664 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has been packed
• File has exports table
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Gemius
File Description	Internet Research Browser Plugin NetPanel
File Version	2, 29, 0, 1 2, 3, 0, 1
Legal Copyright	Copyright (C) 2011 Gemius
Original Filename	IEHELPER.DLL
Product Name	Internet Research NetPanel
Product Version	2, 29, 0, 1 2, 3, 0, 1

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Gemius S.A.	Thawte Code Signing CA - G2	Self Signed
Gemius S.A.	thawte SHA256 Code Signing CA	Self Signed
Gemius S.A.	thawte SHA256 Code Signing CA	Self Signed

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\iehelper.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\iehelper.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\netpanel.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\netpanel.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\netpanel.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\netpanel.new	Synchronize,Write Attributes

Show More

c:\users\user\appdata\local\temp\7zs106b.tmp\files\nmprivate.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\nmprivate.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\nmpublic.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\nmpublic.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\remove.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\remove.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\starter.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\files\starter.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\install.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\install.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\license.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs106b.tmp\license.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\iehelper.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\iehelper.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\netpanel.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\netpanel.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\netpanel.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\netpanel.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\nmprivate.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\nmprivate.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\nmpublic.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\nmpublic.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\remove.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\remove.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\starter.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\files\starter.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\install.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\install.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\license.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs37e6.tmp\license.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\iehelper.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\iehelper.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\netpanel.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\netpanel.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\netpanel.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\netpanel.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\nmprivate.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\nmprivate.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\nmpublic.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\nmpublic.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\remove.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\remove.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\starter.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\files\starter.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\install.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\install.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\license.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs4a24.tmp\license.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\iehelper.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\iehelper.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\netpanel.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\netpanel.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\netpanel.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\netpanel.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\nmprivate.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\nmprivate.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\nmpublic.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\nmpublic.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\rmnetpanel.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\rmnetpanel.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\starter.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\files\starter.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\install.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\install.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\license.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zs737a.tmp\license.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\iehelper.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\iehelper.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\netpanel.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\netpanel.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\netpanel.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\netpanel.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\nmprivate.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\nmprivate.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\nmpublic.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\nmpublic.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\remove.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\remove.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\starter.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\files\starter.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\install.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\install.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\license.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsa34f.tmp\license.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\iehelper.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\iehelper.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\netpanel.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\netpanel.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\netpanel.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\netpanel.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\nmprivate.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\nmprivate.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\nmpublic.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\nmpublic.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\remove.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\remove.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\starter.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\files\starter.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\install.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\install.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\license.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsbccd.tmp\license.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\conditions\terms_and_conditions_2016-03-11.pdf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\iehelper.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\iehelper.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\netpanel.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\netpanel.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\netpanel.new	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\netpanel.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\nmprivate.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\nmprivate.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\nmpublic.key	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\nmpublic.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\remove.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\remove.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\starter.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\files\starter.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\install.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\install.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\license.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zsea61.tmp\license.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\files	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\files\iehelper.new	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\files\iehelper.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\files\netpanel.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\files\netpanel.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\files\netpanel.new	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\files\netpanel.new	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\files\nmprivate.key	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\files\nmprivate.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\files\nmpublic.key	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\files\nmpublic.key	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\files\remove.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\files\remove.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\files\starter.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\files\starter.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\install.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\install.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\license.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\license.txt	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess ShellExecuteEx
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetUserObjectInformation
Keyboard Access	GetKeyState
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtQueryAttributesFile Show More ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWriteFile

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

.\Install.exe

(NULL) C:\Users\Seqtyuhq\AppData\Local\Temp\RarSFX0\Install.exe

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\da463156468080c04c2ecc1bb0ea649a980c3693_0000306672.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\52cbc3fc710225311bbf69f453918001477f1320_0000543416.,LiQMAxHB