arrow_back
search
close

PUA_REVIVER.GA

August 15, 2017
 Analysis by: Michael Jay Villanueva
 ALIASES:

PUP.Optional.RegistryReviver (Malwarebytes); Win64/RegistryReviver.A (ESET-NOD32)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Potentially Unwanted Application

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW


This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

It modifies the Internet Explorer Zone Settings.

  TECHNICAL DETAILS

File Size:

10,714,056 bytes

File Type:

EXE

Initial Samples Received Date:

23 Feb 2017

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Potentially Unwanted Application drops the following files:

  • %System Root%\257e493e-fb12-4d60-a596-554667391420.exe
  • %Program Files%\ReviverSoft\Smart Monitor\msvcp100.dll
  • %Program Files%\ReviverSoft\Smart Monitor\msvcr100.dll
  • %Program Files%\ReviverSoft\Smart Monitor\ReviverSoftSmartMonitor.exe
  • %Program Files%\ReviverSoft\Smart Monitor\ReviverSoftSmartMonitor.mab
  • %Program Files%\ReviverSoft\Smart Monitor\ReviverSoftSmartMonitorService.exe
  • %Program Files%\ReviverSoft\Smart Monitor\ReviverSoftSmartMonitorService.mab
  • %Program Files%\ReviverSoft\Smart Monitor\apps.json
  • %Program Files%\ReviverSoft\Smart Monitor\SystemInfo-vc100-mt.dll
  • %Program Files%\ReviverSoft\Smart Monitor\SystemInfo-vc100-mt.mab
  • %Program Files%\ReviverSoft\Smart Monitor\Plugins\5ae6acfc-937d-43b9-b91e-954fa7ad3f06.1.0.0.4\5ae6acfc-937d-43b9-b91e-954fa7ad3f06.1.0.0.4.dll
  • %Program Files%\ReviverSoft\Smart Monitor\Plugins\78EB6AEF-BCAB-4E11-9315-3B06CCAA1BDD.1.0.0.4\78EB6AEF-BCAB-4E11-9315-3B06CCAA1BDD.1.0.0.4.dll
  • %Program Files%\ReviverSoft\Smart Monitor\Plugins\5ae6acfc-937d-43b9-b91e-954fa7ad3f06.1.0.0.4\5ae6acfc-937d-43b9-b91e-954fa7ad3f06.1.0.0.4.mab
  • %Program Files%\ReviverSoft\Smart Monitor\Plugins\78EB6AEF-BCAB-4E11-9315-3B06CCAA1BDD.1.0.0.4\78EB6AEF-BCAB-4E11-9315-3B06CCAA1BDD.1.0.0.4.mab
  • %Program Files%\ReviverSoft\Smart Monitor\Uninstall.exe
  • %Program Files%\ReviverSoft\Registry Reviver\nfo
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Bulgarian.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Bulgarian1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Bulgarian2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Croatian.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Croatian1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Croatian2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Czech.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Czech1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Czech2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Danish.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Danish1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Danish2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Dutch.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Dutch1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Dutch2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\English.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\English1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\English2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Finnish.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Finnish1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Finnish2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\French.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\French1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\French2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\German.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\German1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\German2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Greek.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Greek1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Greek2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Hungarian.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Hungarian1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Hungarian2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Indonesian.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Indonesian1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Indonesian2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Italian.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Italian1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Italian2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Japanese.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Japanese1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Japanese2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Norwegian.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Norwegian1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Norwegian2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Polish.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Polish1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Polish2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Portuguese.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Portuguese1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Portuguese2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Romanian.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Romanian1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Romanian2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Russian.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Russian1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Russian2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\SimpChinese.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\SimpChinese1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\SimpChinese2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Spanish.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Spanish1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Spanish2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Swedish.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Swedish1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Swedish2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Thai.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Thai1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Thai2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\TradChinese.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\TradChinese1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\TradChinese2
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Turkish.xml
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Turkish1
  • %Program Files%\ReviverSoft\Registry Reviver\defaults\Turkish2
  • %Program Files%\ReviverSoft\Registry Reviver\binary_archive_converter.exe
  • %Program Files%\ReviverSoft\Registry Reviver\msvcp100.dll
  • %Program Files%\ReviverSoft\Registry Reviver\msvcr100.dll
  • %Program Files%\ReviverSoft\Registry Reviver\FileExtensionManager-vc100-mt.dll
  • %Program Files%\ReviverSoft\Registry Reviver\RegistryReviver.exe
  • %Program Files%\ReviverSoft\Registry Reviver\RegistryReviverUpdater.exe
  • %Program Files%\ReviverSoft\Registry Reviver\Uninstall.exe
  • %Program Files%\ReviverSoft\Registry Reviver\tray.exe
  • %Program Files%\ReviverSoft\Registry Reviver\ReviverSoftSmartMonitorSetup.exe
  • %ProgramData%\ReviverSoft\Registry Reviver\{SID}\Settings.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\CommonSettings.xml
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\ReviverSoft\Registry Reviver\Uninstall.lnk
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\ReviverSoft\Registry Reviver\Registry Reviver.lnk
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Bulgarian.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Croatian.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Czech.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Danish.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Dutch.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\English.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Finnish.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\French.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\German.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Greek.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Hungarian.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Indonesian.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Italian.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Japanese.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Korean.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Norwegian.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Polish.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Portuguese.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Romanian.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Russian.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\SimpChinese.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Spanish.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Swedish.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Thai.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\TradChinese.xml
  • %ProgramData%\ReviverSoft\Registry Reviver\Language\Turkish.xml
  • %Windows%\Tasks\Start Registry Reviver for {Computer Name}@{Username}(logon).job
  • %Desktop%\Registry Reviver.lnk
  • %User Temp%\ns{random 1}.tmp
  • %User Temp%\ns{random 2}.tmp\System.dll
  • %User Temp%\ns{random 2}.tmp\ga_utility.exe
  • %User Temp%\ns{random 2}.tmp\nsExec.dll
  • %User Temp%\ns{random 2}.tmp\ns18A1.tmp
  • %User Temp%\ns{random 2}.tmp\ioSpecial.ini
  • %User Temp%\ns{random 2}.tmp\modern-wizard.bmp
  • %User Temp%\ns{random 2}.tmp\nsEnvVariables.dll
  • %User Temp%\ns{random 2}.tmp\InstallOptions.dll
  • %User Temp%\ns{random 2}.tmp\linker.dll
  • %User Temp%\ns{random 2}.tmp\nsProcess.dll
  • %User Temp%\ns{random 2}.tmp\nsSessionSIDW.dll
  • %User Temp%\ns{random 3}.tmp\execDos.dll
  • %User Temp%\ns{random 3}.tmp\System.dll
  • %User Temp%\ns{random 3}.tmp\nsProcess.dll

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

  • %Program Files%\ReviverSoft
  • %Program Files%\ReviverSoft\Smart Monitor
  • %Program Files%\ReviverSoft\Smart Monitor\Plugins
  • %Program Files%\ReviverSoft\Registry Reviver
  • %ProgramData%\ReviverSoft
  • %ProgramData%\ReviverSoft\Registry Reviver
  • %ProgramData%\ReviverSoft\Registry Reviver\{SID}
  • %ProgramData%\ReviverSoft\Registry Reviver\Language
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\ReviverSoft
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\ReviverSoft\Registry Reviver
  • %User Temp%\ns{random 2}.tmp
  • %User Temp%\ns{random 3}.tmp

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Potentially Unwanted Application adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Registry Reviver
AppDir = "%Program Files%\ReviverSoft\Registry Reviver"

HKEY_LOCAL_MACHINE\SOFTWARE\Registry Reviver
Language = "English.xml"

HKEY_LOCAL_MACHINE\SOFTWARE\Registry Reviver
OriginalLang = "English.xml"

Web Browser Home Page and Search Page Modification

This Potentially Unwanted Application modifies the Internet Explorer Zone Settings.

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

  • http://goto.{BLOCKED}rsoft.com/action/?product={value}&LinkType={value}&Language={value}&BuildID={value}&OSource=&t=&UID={UID}&IPAddress={IP Address}&version={Version}&license=&r={value}
  • http://www.{BLOCKED}rsoft.com/registry-reviver/install/?CID={value}&x-trk=&uid={UID}&lang={value}
  • http://www.{BLOCKED}rsoft.com

  SOLUTION

Minimum Scan Engine:

9.850

SSAPI PATTERN File:

1.865.00

SSAPI PATTERN Date:

17 Aug 2017

NOTES:

Trend customers:

    Keep your pattern and scan engine files updated. Trend Micro antivirus software can clean or remove most types of computer threats. Malware, though, such as Trojans, scripts, overwriting viruses and joke programs which are identified as uncleanable, should simply be deleted.

All Internet users:

  • Use HouseCall - the Trend Micro online threat scanner to check for malware that may already be on your PC.
  • Catch malware/grayware before they affect your PC or network. Secure your Web world with Trend Micro products that offer the best anti-threat and content security solutions for home users, corporate users, and ISPs. Go here for more information on Trend Micro products that fit your needs.


Did this description help? Tell us how we did.