PUA.Win32.InstallCore.USMANFAIAQ

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

It connects to certain websites to send and receive information.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following files:

• %User Temp%\000{random characters}.log
• %User Temp%\ish{random numbers}\css\ie6_main.css
• %User Temp%\ish{random numbers}\css\main.css
• %User Temp%\ish{random numbers}\css\sdk-ui\browse.css
• %User Temp%\ish{random numbers}\css\sdk-ui\button.css
• %User Temp%\ish{random numbers}\css\sdk-ui\checkbox.css
• %User Temp%\ish{random numbers}\css\sdk-ui\images\button-bg.png
• %User Temp%\ish{random numbers}\css\sdk-ui\images\progress-bg-corner.png
• %User Temp%\ish{random numbers}\css\sdk-ui\images\progress-bg.png
• %User Temp%\ish{random numbers}\css\sdk-ui\images\progress-bg2.png
• %User Temp%\ish{random numbers}\css\sdk-ui\progress-bar.css
• %User Temp%\ish{random numbers}\csshover3.htc
• %User Temp%\ish{random numbers}\fciv.exe
• %User Temp%\ish{random numbers}\form.bmp.Mask
• %User Temp%\ish{random numbers}\images\BG.png
• %User Temp%\ish{random numbers}\images\Close.png
• %User Temp%\ish{random numbers}\images\Close_Hover.png
• %User Temp%\ish{random numbers}\images\Color_Button.png
• %User Temp%\ish{random numbers}\images\Color_Button_Hover.png
• %User Temp%\ish{random numbers}\images\Grey_Button.png
• %User Temp%\ish{random numbers}\images\Grey_Button_Hover.png
• %User Temp%\ish{random numbers}\images\Icon_Generic.png
• %User Temp%\ish{random numbers}\images\Loader.gif
• %User Temp%\ish{random numbers}\images\Pause_Button.png
• %User Temp%\ish{random numbers}\images\Progress.png
• %User Temp%\ish{random numbers}\images\ProgressBar.png
• %User Temp%\ish{random numbers}\images\Quick_Specs.png
• %User Temp%\ish{random numbers}\images\Resume_Button.png
• %User Temp%\ish{random numbers}\images\sponsored.png
• %User Temp%\ish{random numbers}\images\step01.png
• %User Temp%\ish{random numbers}\images\step02.png
• %User Temp%\ish{random numbers}\images\step03.png
• %User Temp%\ish{random numbers}\images\step04.png
• %User Temp%\ish{random numbers}\locale\DE.locale
• %User Temp%\ish{random numbers}\locale\EN.locale
• %User Temp%\ish{random numbers}\locale\ES.locale
• %User Temp%\ish{random numbers}\locale\FR.locale
• %User Temp%\ish{random numbers}\locale\JA.locale
• %User Temp%\ish{random numbers}\locale\PL.locale
• %User Temp%\ish{random numbers}\locale\PT.locale
• %User Temp%\ish{random numbers}\locale\RU.locale
• %User Temp%\ish{random numbers}\bootstrap_32596.html
• %User Temp%\is{random numbers}\7424B7EA_stp.DAT
• %User Temp%\is{random numbers}\7424B7EA_stp.DAT.part
• %User Temp%\ICReinstall_{malware filename}.exe
• %Desktop%\Continue FileZilla Installation.lnk

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %User Temp%\ish{random numbers}\css\
• %User Temp%\ish{random numbers}\css\sdk-ui
• %User Temp%\ish{random numbers}\css\sdk-ui\images
• %User Temp%\ish{random numbers}\images
• %User Temp%\ish{random numbers}\locale
• %User Temp%\is{random numbers}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Propagation

This Potentially Unwanted Application does not have any propagation routine.

Backdoor Routine

This Potentially Unwanted Application does not have any backdoor routine.

Information Theft

This Potentially Unwanted Application does not have any information-stealing capability.

Other Details

This Potentially Unwanted Application connects to the following website to send and receive information:

• http://rp.{BLOCKED}forgecdn.com/?pcrc={CRC value}&v={version}
• http://os2.{BLOCKED}forgecdn.com/SourceForge_FLZ/?v={version}&c=942370647
• http://os.{BLOCKED}forgecdn.com/SourceForge_FLZ/?v={version}&c=942370647

It does the following:

• It displays the following during installation:
  
  
• Connects to the following URL to download installer-related files:
  • http://do{BLOCKED}.sourc{BLOCKED}e.net/project/filez{BLOCKED}la%20Server/0.9.49/FileZilla_Server-0_9_49.exe?r=http%3A%2F%2F{BLOCKED}cts%2Fsfnet_filezilla%2Fdownloads%2FFileZilla%2520Ser{BLOCKED}%2FFileZilla_Server-0_9_49.e{BLOCKED}15964&use_mirror=jaist&secret=fdcca4c49ed1{BLOCKED}8f475cb3a04bc04d3a708ff03be9cf6

NOTES:

Rootkit Capabilities

This Potentially Unwanted Application does not have rootkit capabilities.

This Potentially Unwanted Application does not exploit any vulnerability.