PUP.GPass

The detection of PUP.GPass on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it to prevent any potential harm.

What Is PUP.GPass?

PUP.GPass is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may not be malicious in nature but can still cause problems, such as slowing down your computer, displaying unwanted advertisements, or collecting your personal data. PUP.GPass, in particular, may have been bundled with other software or downloaded from the internet, and its presence on your system may be causing concerns about your privacy and security.

How PUP.GPass Operates

PUP.GPass, like other PUPs, may operate by installing itself on your system and running in the background, often without your knowledge or consent. It may collect your browsing data, display unwanted advertisements, or redirect you to suspicious websites. In some cases, PUPs may also install additional software or modify your system settings, which can lead to further problems. It is crucial to remove PUP.GPass and any associated software to prevent any potential harm to your system and data.

Symptoms of Infection

If your system is infected with PUP.GPass, you may experience a range of symptoms, including slowed-down performance, unwanted advertisements, and suspicious activity. You may also notice that your browser settings have been modified, or that new software has been installed without your consent. In some cases, you may receive alerts or warnings from your antivirus software, indicating the presence of a PUP on your system. If you suspect that your system is infected with PUP.GPass, it is essential to take immediate action to remove it.

How to Remove PUP.GPass

1. Boot your computer in Safe Mode with Networking to prevent PUP.GPass from running and to allow for a more effective removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any associated malware or PUPs.
3. Uninstall any suspicious programs or software that may be related to PUP.GPass, using the Control Panel or Settings app.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any modified settings or extensions.
5. Reboot your computer and perform a follow-up scan with your anti-malware tool to ensure that PUP.GPass and any associated malware have been completely removed.

Conclusion

Removing PUP.GPass from your system is crucial to preventing any potential harm to your computer and data. By following the steps outlined above, you can effectively remove this potentially unwanted program and restore your system to a safe and secure state. It is also essential to be cautious when downloading software from the internet and to always read the terms and conditions before installing any new applications. By taking these precautions, you can help protect your system from PUPs like PUP.GPass and maintain a safe and secure online experience.

Analysis Report

General information

Family Name:	PUP.GPass
Signature status:	Root Not Trusted

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 9cf4506a4fbef352da0de1a38eb7d08e SHA1: e8bd6ab850f0e72c9597a0656419994c59d78c6e SHA256: 08CC14C1AE58ACF9F1701F186AC09005B1D5A0E6657F3DA912503B65B875A77D File Size: 1.99 MB, 1989392 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup: http://www.innosetup.com
Company Name	GPass
File Description	GPass Setup
File Version	2.0.20.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
The World Gate, Inc	UTN-USERFirst-Object	Root Not Trusted

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ebkou.tmp\is-0ccjl.tmp	Generic Write,Read Attributes

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Rrulrjug\AppData\Local\Temp\is-EBKOU.tmp\is-0CCJL.tmp" /SL4 $100052 "c:\users\user\downloads\e8bd6ab850f0e72c9597a0656419994c59d78c6e_0001989392" 1745832 52224