PUP.MSIL.Brute.HO

The detection of PUP.MSIL.Brute.HO on your system indicates the presence of a potentially unwanted program (PUP) that may compromise your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it and prevent further damage. In this report, we will provide an overview of PUP.MSIL.Brute.HO, its operating mechanisms, symptoms of infection, and a step-by-step guide on how to remove it from your system.

What Is PUP.MSIL.Brute.HO?

PUP.MSIL.Brute.HO is a type of potentially unwanted program that can be installed on your computer without your knowledge or consent. It may be bundled with other software or downloaded from the internet, often through deceptive or misleading means. Once installed, PUP.MSIL.Brute.HO can perform various malicious activities, such as collecting sensitive information, displaying unwanted advertisements, or disrupting system performance.

How PUP.MSIL.Brute.HO Operates

PUP.MSIL.Brute.HO operates by exploiting vulnerabilities in your system or using social engineering tactics to trick you into installing it. Once installed, it can communicate with its command and control servers to receive instructions and transmit stolen data. It may also use various techniques to evade detection, such as code obfuscation or anti-debugging methods. PUP.MSIL.Brute.HO can also install additional malware or unwanted programs on your system, further compromising its security and performance.

Symptoms of Infection

The symptoms of PUP.MSIL.Brute.HO infection can vary, but common indicators include unwanted pop-ups or advertisements, slow system performance, unexpected crashes or freezes, and suspicious network activity. You may also notice unfamiliar programs or icons on your desktop or taskbar, or receive alerts from your antivirus software. If you suspect that your system is infected with PUP.MSIL.Brute.HO, it is crucial to take immediate action to remove it and prevent further damage.

How to Remove PUP.MSIL.Brute.HO

1. Boot your computer in Safe Mode with Networking to prevent PUP.MSIL.Brute.HO from loading and to allow for a more effective removal process.
2. Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove PUP.MSIL.Brute.HO and any related malware.
3. Uninstall any suspicious programs or applications that may be related to PUP.MSIL.Brute.HO, using the Control Panel or Settings app.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
5. Reboot your computer and perform a follow-up scan with your anti-malware tool to ensure that PUP.MSIL.Brute.HO has been completely removed.

Conclusion

Removing PUP.MSIL.Brute.HO from your system requires careful attention to detail and a thorough understanding of its operating mechanisms. By following the steps outlined in this report, you can effectively remove PUP.MSIL.Brute.HO and prevent further damage to your system. It is essential to remain vigilant and take proactive measures to protect your computer from future malware infections, such as keeping your operating system and software up to date, using strong antivirus software, and avoiding suspicious downloads or links.

Analysis Report

General information

Family Name:	PUP.MSIL.Brute.HO
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 26fcf8a8f4388fdc0aa376cb724530f4 SHA1: 8217a82f605a334b42fbfec6ee228b3590b23f06 SHA256: 95667FF919D832EF466E7B67BD2A4FE9B77F303B23D22B39BB1A094C77D36B9C File Size: 7.08 MB, 7082157 bytes

MD5: 01dff2ebc38c1bff0f248874775eaed2 SHA1: 84db0f672596dd4655127e8c4e15a23740e8b6bb SHA256: AF594C98DDEDE832CF442F423FE18C6C39403EF4EE614F6B62B2B16C96740D85 File Size: 7.07 MB, 7074550 bytes

MD5: 31b66421021645a2228df202033d514c SHA1: 33781caeb78d1c8dc4a6d95c9f6d4738e894f725 SHA256: 8F9657B1375BC442C2A8EA71297412990210C339E6F7D96841D4E0263150087A File Size: 7.09 MB, 7088384 bytes

MD5: 5aa8507ecac5f3548c0db5633033ef02 SHA1: 5dc80e317d83d12edef0e40421dbcd2b0ca5e0b4 SHA256: 5F0B35970346C518978822767C84B66F498877C99C02DFD50EEE9067365A23D6 File Size: 7.07 MB, 7069430 bytes

MD5: bd2de62142f95b917664df2b09d7f273 SHA1: 4f0296e4dee63d131d67a943544441dcee87eafa SHA256: A1E8C237CBC3A0C4F76EF7C65847B16BED2CB107F4B7057D0273FA6DB7406860 File Size: 7.07 MB, 7070976 bytes

Show More

MD5: 6d3dd5ac503f6160d1f15ec36a965daa SHA1: d259a8cb6404b4668345d5386cb3202ae3f59d96 SHA256: 9BF6C58A9955ABFEDA264E8CD971E88FA84C9761F07E2889C523B3F534C2D9BC File Size: 7.09 MB, 7089408 bytes

MD5: bb899005264f49b9986c81e02ea8f41a SHA1: 225a4bcd507299a1a521f66af455d55ee618f40c SHA256: DF43822158E6F253371FFD4F70AADAF3679F70F44906D27D0578BB24979C8015 File Size: 7.07 MB, 7069430 bytes

MD5: 232fd6eef30154b11d00669ede8ba530 SHA1: 0f1f72045d3d8a5923d698c846d254d65c156f62 SHA256: 525A0D0E422E763125405C2816C6812432238448DB2A7ED93AF75DCA43C44813 File Size: 7.08 MB, 7080621 bytes

MD5: 43bdc811fdf19bf7c8db0e29ebc4a21d SHA1: 33ebdfa5c0bbd6857bd7b6b238f8a909becd27d5 SHA256: 2459DDAA20B43584C03C339271491BE40B4A7AE1D4B53A26765292751BAE1E47 File Size: 7.09 MB, 7091968 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

File Traits

• big overlay
• Installer Manifest
• No Version Info
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	163
Potentially Malicious Blocks:	3
Whitelisted Blocks:	160
Unknown Blocks:	0

Visual Map

0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\afolder\7za.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\afolder\batclen.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\afolder\idman.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\afolder\nsudolc.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\i6.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\i6.f	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\i6.t	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t14198.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t14198.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t16769.bat	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\wtmpd\t16769.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t17797.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t17797.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t19592.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t19592.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t22824.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t22824.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t25377.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t25377.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t25632.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t25681.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t26491.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t26491.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t56865.bat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wtmpd\t56865.exe	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	祀纟鋵ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	⃲铝ǜ	RegNtPreCreateKey

Show More

HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	˥쮎ꦏǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	⢍꼕ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	攍➛뭐ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	ꄰ䭰봒ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	虞蘿샤ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	῕װퟆǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	挏⾾羅ǜ	RegNtPreCreateKey
HKLM\software\classes\typelib\{1ea4dbf0-3c3b-11cf-810c-00aa00389b71}\1.1\0\win32::	C:\WINDOWS\SysWow64\Oleacc.dll	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\proxystubclsid32::	{00020424-0000-0000-C000-000000000046}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\typelib::	{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\typelib::version	1.1	RegNtPreCreateKey
HKLM\software\classes\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\proxystubclsid32::	{00020424-0000-0000-C000-000000000046}	RegNtPreCreateKey
HKLM\software\classes\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\typelib::	{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}	RegNtPreCreateKey
HKLM\software\classes\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\typelib::version	1.1	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\proxystubclsid32::	{00020424-0000-0000-C000-000000000046}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\typelib::	{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\typelib::version	1.1	RegNtPreCreateKey
HKLM\software\classes\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\proxystubclsid32::	{00020424-0000-0000-C000-000000000046}	RegNtPreCreateKey
HKLM\software\classes\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\typelib::	{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}	RegNtPreCreateKey
HKLM\software\classes\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\typelib::version	1.1	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	ShellExecuteEx
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Terminate	TerminateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

open C:\Users\Juztupxm\AppData\Local\Temp\i6.bat

open C:\Users\Ztrjfseb\AppData\Local\Temp\i6.bat

open C:\Users\Invbcjhi\AppData\Local\Temp\i6.bat

open C:\Users\Obuahvoq\AppData\Local\Temp\i6.bat

open C:\Users\Atgpmrgr\AppData\Local\Temp\i6.bat

Show More

open C:\Users\Ivstnfjq\AppData\Local\Temp\i6.bat

open C:\Users\Vaqqscke\AppData\Local\Temp\i6.bat

open C:\Users\Sqcmiiii\AppData\Local\Temp\i6.bat

open C:\Users\Danupyhd\AppData\Local\Temp\i6.bat