PUA.Win64.PCHunter.A

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following component file(s):

• {Malware Path}\{Malware Filename}ak.sys

Autostart Technique

This Potentially Unwanted Application registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}ak

Other System Modifications

This Potentially Unwanted Application deletes the following files:

• {Malware Path}\{Malware Filename}ak.sys

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}ak
Type = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}ak
ErrorControl = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}ak
Start = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}ak
ImagePath = \??\{Malware Path}\{Malware Filename}ak.sys

Backdoor Routine

This Potentially Unwanted Application connects to the following websites to send and receive information:

• http://www.ep{BLOCKED}t.com
• http://www.e{BLOCKED}t.com/PCHunter_StandardV1.4={MAC Address}
• http://www.e{BLOCKED}t.com/pchunter/pchunter_free
• {BLOCKED}.{BLOCKED}.158.231

Adware Routine

This Potentially Unwanted Application deletes the following registry keys that were created during execution:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}ak\Enum

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}ak

Information Theft

This Potentially Unwanted Application gathers the following data:

• MAC Address
• Running Processes
• Computer Files
• User Accounts
• System Registries
• Process Modules
• Kernel Modules
• Startup Information
• Network Connections
• Firewall Rules

Other Details

This Potentially Unwanted Application does the following:

• It loads the dropped file as a driver
  • {Malware Path}\{Malware Filename}ak.sys
• It displays the following image:
  
• It can view and display system process and process threads
• It can terminate, suspend and resume processes and threads
• It displays current network connections, including the local and remote addresses and state of TCP connections
• It displays and can edit system registry
• It displays and can delete files and folders
• It can view file properties information
• It displays autorun entries
• It can delete and edit autorun entries
• It displays and can delete user accounts
• It displays affected machine’s firewall rules
• It can delete a firewall rule