PUA.Win32.DriverUpdater.BY

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Ordner hinzu:

• %AppDataLocal%\Slimware Utilities Inc (Contains settings and configuration files)
• %Program Files%\Slimware Utilities (Contains installed application and components)
• %Program Files%\DriverUpdate (Contains installed application and components)

(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.)

Schleust die folgenden Dateien ein:

• %User Temp%\{random}.tmp
• %User Temp%\{random}.tmp.msi
• %User Temp%\{random}.tmp.exe

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• %Program Files%\DriverUpdate\DriverUpdate.exe -installscan
• %User Temp%\{random}.tmp.exe SI_LAUNCH=onreboot SI_MODE=toaster SI_DELAY=5 @P2_ORIGIN={random characters}@P2={random characters}@UL_STUBID={stub id}
• %Program Files%\Internet Explorer\iexplore.exe "http://www.{BLOCKED}update.net/scan_results/index.php?lang=en&installer_data={encoded information}&machineId={machine id}&installId={install id}"

Autostart-Technik

Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
DriverUpdate = %Program Files%\DriverUpdate\DriverUpdate.exe -boot

Startet die folgenden Dienste:

• Name : SlimWareServices
  Image path: %Program Files%\Slimware Utilities\Services\Slimware.Services.exe

(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.)

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Andere Details

Fügt die folgenden Registrierungsschlüssel hinzu:

HKEY_LOCAL_MACHINE\SOFTWARE\SlimWare Utilities Inc (Contains configuration and information of installed application)

HKEY_CURRENT_USER\Software\SlimWare Utilities Inc (Contains configuration and information of installed application)

Es macht Folgendes:

• It connects to the following URL to send and receive information regarding installation:
  • http://trk.{BLOCKED}reutilities.com/ulc.php?ev={Installer Event}&upl={Encoded Information}&machineId={Machine ID}&platformOS={Operating System}&platformOSVersion={Operating System Version}&installer={Installer}&installerVersion={Installer Version}&product={Product Version}&msBclVersion={BCL Version}
  • http://trk.{BLOCKED}reutilities.com/ulc.php?ev={Installer Event}&upl={Encoded Information}&machineId={Machine ID}&platformOS={Operating System}&platformOSVersion={Operating System Version}&installer={Installer}&installerVersion={Installer Version}&product={Product Version}
  • http://trk.{BLOCKED}reutilities.com/ulc.php?ev={Installer Event}&upl={Encoded Information}&machineId={Machine ID}&platformOS={Operating System}&platformOSVersion={Operating System Version}&installer={Installer}&installerVersion={Installer Version}&product={Product Version}&installId={Install ID}&description={Description}&result={Result}
  • http://trk.{BLOCKED}reutilities.com/ulc.php?ev={Installer Event}&upl={Encoded Information{&machineId={Machine ID}&platformOS={Operating System}&platformOSVersion={Operating System Version}&installer={Installer}&installerVersion={Installer Version}&product={Product}&installId={Install ID}&errorType={Error Type}&errorCode={Error Code}&page=app-side-error&action={Action}
  • http://trk.{BLOCKED}reutilities.com/ulc.php?ev={Installer Event}&platformOSVersion={Operating System Version}&secondOfferOrigin={Random}&ul_stubid={Stub ID}&p2={Random}&installer={Installer}&product={Product Version}&installerVersion={Installer Version}&machineId={Machine ID}&platformOS={Operating System]
  • http://stc.{BLOCKED}reutilities.com/gettrack?product={Product}&p2={Random}&secondOfferOrigin={Random}&ul_stubid={Stub ID}
  • http://apps-api.{BLOCKED}reutilities.com/
• It sends the following information regarding installation:
  • Installer event
  • Default browser information (e.g. browser name, browser language)
  • Operating system information (e.g. name, version)