Home / malware

PDF

PUA:Win32/Qjwmonkey

First posted on 07 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/Qjwmonkey.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• url.tudown.com
• down10.zol.com.cn
• dx1.xiazaizhijia.com
• url.goosai.com
• 119.90.25.23

We have seen this application use the following file names:

• Adobe@83_7719.exe
• office2010官方下载+免费完整版@168_18237.exe
• PS+CS6@25_40856.exe
• KMS@25_105573.exe
• 小马win10永久激活工具+v20160530+官方版@135_46251.exe
• photoshop7.0中文版下载@168_751.exe
• qjwm_setup.exe
• Microsoft+Office+2013+免费完整版（32&64位）++-+一套办公室套装软件@162_41496.exe
• Adobe+Photoshop+CS6+简体中文版@133_15126.exe

It can be digitally signed by the following vendors:

• Hefei Lewei Information Technology Co.,Ltd.
• Anhui Shuyang Science and Technology Co., Ltd.
• Ruifeng Network Technology Co., Ltd.
• Maanshan Zhiye Software Technology Co.,Ltd.
• Anhui Haiyang Software Technology Co., Ltd.

We have seen this application using product names such as:

• downloader
• downloader of lewell
• Downloader
• speed cloud download
• 下载器

This application communicates with domains such as:

• api.baizhu.cc
• 182.254.152.12
• download.downxia.com
• psoft.33lc.com
• down.cncrk.com

For example:

• api.baizhu.cc/api/getdown
• api.baizhu.cc/api/getdown
• api.baizhu.cc/api/open

Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

• Installs programs that start automatically when your PC starts
• Installs a driver on your PC
• Injects into other processes on your system
• Modifies file associations on your system
• Changes your browser's default homepage settings
• Changes your browser's default search provider settings
• Changes your browser's shortcuts - often this can be used to take over your homepage by adding command-line arguments that change how the page is loaded
• Installs extensions into your browsers - often this is used to inject ads, add toolbars, or change how your browser works
• Changes the Google Chrome secure preferences - this behavior is commonly associated with tampering with the default homepage or search provider in Chrome
• Tampers with Windows Group Policy settings

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• XY传奇盛世
• 百度输入法
• 传奇盛世
• 360安全卫士
• QQ浏览器
• USB大师
• 乐熊游戏浏览器
• 快新游戏盒
• Compress

This description was published using automated analysis.

Last update 07 July 2016

 

TOP