Home / malwarePDF  

SoftwareBundler:Win32/Zubtui.A


First posted on 27 October 2015.
Source: Microsoft

Aliases :

There are no other names known for SoftwareBundler:Win32/Zubtui.A.

Explanation :

Threat behavior

Installation
This threat can create files on your PC, including:

  • %LOCALAPPDATA%\microsoft\windows\temporary internet files\content.ie5\6wm0pkj1\baidupinyinsetup_3.0.2.62_sw-0000161993[1].exe
  • %LOCALAPPDATA%\microsoft\windows\temporary internet files\content.ie5\ezalqeoe\bdbrowsersetup-7.5.502.1764-ftn_1000161993[1].exe
  • %LOCALAPPDATA%\microsoft\windows\temporary internet files\content.ie5\oqasdouf\baiduan.setup.0528.4.0.0.8029_1000161993[1].exe
  • %LOCALAPPDATA%\microsoft\windows\temporary internet files\content.ie5\twi4n4w6\baidusd.setup.3.0.0.4611.youqian_1000161993[1].exe
  • %TEMP%\baiduan.setup.0528.4.0.0.8029_1000161993.exe
  • %TEMP%\baidupinyinsetup_3.0.2.62_sw-0000161993.exe
  • %TEMP%\baidusd.setup.3.0.0.4611.youqian_1000161993.exe
  • %TEMP%\bdbrowsersetup-7.5.502.1764-ftn_1000161993.exe


The malware uses code injection to make it harder to detect and remove. It can inject code into running processes.



Payload


Connects to a remote host

We have seen this threat connect to a remote host. Malware can connect to a remote host to do any of the following:
  • Check for an Internet connection
  • Download and run files (including updates or other malware)
  • Report a new infection to its author
  • Receive configuration or other data
  • Receive instructions from a malicious hacker
  • Search for your PC location
  • Upload information taken from your PC
  • Validate a digital certificate


This malware description was published using automated analysis of file SHA1 7a302665f6f2312550e3554537001ef9d31abe60.

Symptoms

The following can indicate that you have this threat on your PC:

  • You see a file similar to:
    • %LOCALAPPDATA%\microsoft\windows\temporary internet files\content.ie5\6wm0pkj1\baidupinyinsetup_3.0.2.62_sw-0000161993[1].exe
    • %LOCALAPPDATA%\microsoft\windows\temporary internet files\content.ie5\ezalqeoe\bdbrowsersetup-7.5.502.1764-ftn_1000161993[1].exe
    • %LOCALAPPDATA%\microsoft\windows\temporary internet files\content.ie5\oqasdouf\baiduan.setup.0528.4.0.0.8029_1000161993[1].exe
    • %LOCALAPPDATA%\microsoft\windows\temporary internet files\content.ie5\twi4n4w6\baidusd.setup.3.0.0.4611.youqian_1000161993[1].exe
    • %TEMP%\baiduan.setup.0528.4.0.0.8029_1000161993.exe
    • %TEMP%\baidupinyinsetup_3.0.2.62_sw-0000161993.exe
    • %TEMP%\baidusd.setup.3.0.0.4611.youqian_1000161993.exe
    • %TEMP%\bdbrowsersetup-7.5.502.1764-ftn_1000161993.exe

Last update 27 October 2015

 

TOP

Malware :

Family: