Home / malware

PDF

PUA:Win32/MediaGet

First posted on 22 June 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/MediaGet.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• ld.mediaget.com
• ld1.mediaget.com
• mediaget.com
• download.mediaplay.ru
• www.softsalad.ru

We have seen this application use the following file names:

• MediaGet.exe
• index2[1].exe
• MediaGet2.exe
• half_open_limit_fix_4.2.exe
• agario-powerups-bot-hilesi_id1130881ids1s.exe
• MediaGet_id2027348ids2s.exe
• MediaGet2_ressoftodromres.exe
• mediaget.exe
• agario-powerups.zip
• uTorrent.exe

It can be digitally signed by the following vendors:

• Inbox OOO
• Banner LLC
• Media Get LLC
• Media. LLC

We have seen this application using product names such as:

• mediaget-installer Module
• MediaGet
• MediaPlay-installer Module
• MediaPlay
• Half-open limit fix

This application communicates with domains such as:

• download.mediaget.com
• ld2.mediaget.com
• ld1.mediaget.com
• sub2.bubblesmedia.ru

For example:

• ld2.mediaget.com/getdata.php?
• ld1.mediaget.com/getdata.php?
• sub2.bubblesmedia.ru/client/mediaget_install?

Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

• Installs programs that start automatically when your PC starts
• Installs a driver on your PC
• Injects into other processes on your system
• Modifies file associations on your system
• Installs extensions into your browsers - often this is used to inject ads, add toolbars, or change how your browser works
• Abuses Group Policy settings to install extensions into your browser without your consent
• Changes the Google Chrome secure preferences - this behavior is commonly associated with tampering with the default homepage or search provider in Chrome
• Uses Group Policy to control your browser settings - this should only be used by network administrators
• Tampers with Windows Group Policy settings

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• 360 Total Security
• MediaGet
• Tarayıcı Yöneticisi
• Менеджер браузеров
• Grand Theft Auto San Andreas + MultiPlayer [0.3e]
• Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
• Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
• Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
• DAEMON Tools Lite
• Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

This description was published using automated analysis.

Last update 22 June 2016

 

TOP