Home / malware

PDF

PUA:Win32/SystemHealer

First posted on 04 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/SystemHealer.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• cd.supercleanhost.net
• da.systemhealerhost.net
• vd.onesystemhost.net

We have seen this application use the following file names:

• SuperPCCleaner.exe
• OneSystemCare.exe
• SuperPCCleaner (1).exe
• SystemHealer.exe
• OneSystemCare (1).exe
• SuperPCCleaner (2).exe
• SystemHealer (1).exe
• SuperPCCleaner(1).exe
• SuperPCCleaner (3).exe

It can be digitally signed by the following vendors:

• System Healer Tech Sp. Zo.o.
• One System Care Limited
• One System Care Sp. Zo.o.
• One System Care
• PC Cleaner Tech Limited

We have seen this application using product names such as:

• AppCashier
• SystemHealer.exe
• Super PC Cleaner Console
• SuperPCCleaner.exe
• TODO: 7o5v2c0j6p4w1d8k5q3x

This application communicates with domains such as:

• callbanner.onesystemcare.com
• isystemhealer.com
• ionesystemcare.info
• set-control.info
• healergroup.net

For example:

• callbanner.onesystemcare.com/?
• isystemhealer.com/inst?
• ionesystemcare.info/inst?

Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

• Modifies your DNS settings - we sometimes see this used to inject ads into your browser as you browse the web

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• System Healer
• DNSWAXHAW version 1.4
• One System Care
• Super Updater v3.1
• Driver Pro v3.2.0.2
• GeekBuddy
• Reimage Repair
• UpdateAdmin

This description was published using automated analysis.

Last update 04 July 2016

 

TOP