Home / malware

PDF

PUA:Win32/BetterInstall

First posted on 31 March 2019.
Source: Microsoft

Aliases :

PUA:Win32/BetterInstall is also known as not-a-virus:Downloader.NSIS.Agent.ef, RDN/Generic.bfr!hr, Win32/Somoto.N application, Somoto BetterInstaller, ADW_TOMOS, NS:Trojan.Somoto!1.A49B [F], Application.Bundler.Somoto.G, Trojan.ADH.2.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

sub.spirlymo.com static.bicdn.com gsmevolution.com schulethusis.sharepoint.com www.officialares.com

We have seen this application use the following file names:

ClickHeretoDownloadSetup-4a8bR5ZD.exe ClickHeretoDownloadSetup-2rs8NOOp.exe ClickHeretoDownloadSetup-bLXPgMEY.exe ClickHeretoDownloadSetup-bmrNRBCC.exe DVDShrink_downloader_by_DVDShrink.exe 7ZipSetup.exe UnlockRoot_downloader_by_UnlockRoot.exe ClickHeretoDownloadSetup-4a8bR5ZD (1).exe ClickHeretoDownloadSetup-2rs8NOOp (1).exe

It can be digitally signed by the following vendors:

Somoto Ltd. Somoto Israel Somoto Limited SITE ON SPOT Ltd. DSNR Media Group

We have seen this application using product names such as:

Better Installer

This application communicates with domains such as:

sub.yorkshatb.com dsw77od72w729.cloudfront.net d1x73t29gz9b9u.cloudfront.net d2sqeu7webp16b.cloudfront.net d28qnix3oghykq.cloudfront.net

For example:

sub.yorkshatb.com/pinger? d2sqeu7webp16b.cloudfront.net/images/Tokyo/tokyo_sprite_full.png d2sqeu7webp16b.cloudfront.net/images/Tokyo/tokyo_sprite_full.png Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

Installs programs that start automatically when your PC starts Injects into other processes on your system Changes your browser's shortcuts - often this can be used to take over your homepage by adding command-line arguments that change how the page is loaded Installs extensions into your browsers - often this is used to inject ads, add toolbars, or change how your browser works Injects code into your browsers - this suspicious behavior is often used to bypass firewall settings or to change how your browser works

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

FilesFrog Update Checker Social2Search Shopper-Pro YouTube Accelerator Bubble Dock Chromatic Genieo WindApp DVD Shrink 3.2

This description was published using automated analysis.

Last update 31 March 2019

 

TOP