Home / malware

PDF

PUA:Win32/iBryteInstaller

First posted on 04 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/iBryteInstaller.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• secure.fileldr08.com
• cf1.vuze.com
• dl1.filehippo.com
• dl2.filehippo.com
• heanet.dl.sourceforge.net

We have seen this application use the following file names:

• Setup.exe
• mplayer_Setup.exe
• setup.exe
• VuzeBittorrentClientInstaller.exe
• downloadmanager_Setup.exe
• Setup (1).exe
• mplayer_Setup (1).exe
• Flash_Player_Pro_Setup.exe
• Setup(1).exe

It can be digitally signed by the following vendors:

• Optimum Installer
• Sail Machine
• System Applet
• FUSION INSTALLER
• WARP INSTALLER

We have seen this application using product names such as:

• Premium Installer
• Fusion Install
• SetupManager.exe
• DownloadManager.exe
• OptimumInstaller

This application communicates with domains such as:

• plugins.vuze.com
• tracker.update.vuze.com
• client.vuze.com
• d2e24t2jgcnor2.cloudfront.net
• btpr.vuze.com

For example:

• plugins.vuze.com/update/pluginlist3.php?
• tracker.update.vuze.com:6969/announce?
• client.vuze.com/donation/sidebar_promo.php

Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

• Installs programs that start automatically when your PC starts
• Injects into other processes on your system
• Modifies file associations on your system
• Changes your browser's default homepage settings
• Changes your browser's default new tab page settings
• Changes your browser's default search provider settings
• Changes the Google Chrome secure preferences - this behavior is commonly associated with tampering with the default homepage or search provider in Chrome
• Changes your browser's proxy settings - we often see this used to inject ads into your browser as you browse the web
• Modifies your browser proxy settings to local host - this is commonly used to inject ads into your browsers
• Disables User Access Control (UAC) on your system

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• Vuze
• Malware Protection Live
• Raptr
• Browser Extensions
• Adobe Flash Player 22 NPAPI
• IDM Crack 6.25 build 20
• Social2Search
• DAEMON Tools Lite
• Search the Web (Yahoo)

This description was published using automated analysis.

Last update 04 July 2016

 

TOP