Home / malware

PDF

SoftwareBundler:Win32/InstallMonster

First posted on 01 June 2019.
Source: Microsoft

Aliases :

There are no other names known for SoftwareBundler:Win32/InstallMonster.

Explanation :

Installation This program is a software bundler that can install third-party software. We have seen it bundling other applications as it installs software.   See the following sample screenshots:            It can make various registry changes during its installation, including:

In subkey: HKLMSoftwareClassesCLSID{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}LocalServer32
Sets value: "(default)"
With data: ""

In subkey: HKLMSoftwareClasses.DynamicNSClsid
Sets value: "(default)"
With data: "{c379ead1-cb34-4b09-af6b-7e587f8bcd80}"

Payload

Connects to a remote host

We have seen this threat connect to a remote host, including: d15s6fp44gckh76.midjewejes.ru 9i7ffdgvffibow7.vrnserver.ru Malware can connect to a remote host to do any of the following: Check for an Internet connection Download and run files (including updates or other malware) Report a new infection to its author Receive configuration or other data Receive instructions from a malicious hacker Search for your PC location Upload information taken from your PC Validate a digital certificate

 

Additional information

Creates a mutex

This threat can create one or more mutexes on your PC. For example:

MutexNPA_UnitVersioning_3184

It might use this mutex as an infection marker to prevent more than one copy of the threat running on your PC.

This malware description was published using automated analysis of file SHA1 d1849a01f6717065d218fbeab8f79b185fdb3a93.

Last update 01 June 2019

 

TOP