Home / malware

PDF

PUA:Win32/Somoto

First posted on 23 June 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/Somoto.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• getvdownloader.com.br
• sub.yorkshatb.com
• download.majorshare.com
• s3.amazonaws.com
• www.wifihotspotcreator.com

We have seen this application use the following file names:

• DTLite4491-0356.exe
• DTLite4481-0347.exe
• VDownloader4OC.exe
• DTLite4471-0337.exe
• DTLite4471-0335.exe
• DAEMON Tools Lite 4.49.1.0356.exe
• DAEMON Tools Lite 10.0.0.54.exe
• DAEMONToolsUltra240-0280.exe
• IZArcInstall.exe
• UpdateMyDrivers.exe

It can be digitally signed by the following vendors:

• Somoto Ltd.
• SITE ON SPOT Ltd.
• Somoto Israel
• Open Source Developer. Somoto-inc Limited
• Site on Spot Limited

We have seen this application using product names such as:

• DAEMON Tools Lite
• DAEMON Tools Ultra
• DAEMON Tools Pro
• VDownloader
• Better Installer

Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

• Installs programs that start automatically when your PC starts
• Injects into other processes on your system
• Modifies file associations on your system
• Changes your browser's shortcuts - often this can be used to take over your homepage by adding command-line arguments that change how the page is loaded
• Installs extensions into your browsers - often this is used to inject ads, add toolbars, or change how your browser works
• Installs a trusted root certificate authority on your PC - this is a dangerous behavior that can undermine the security of your PC and web browsing. Most commonly, we see this being used by ad-injection applications that insert ads in your browser as you browse the web

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• DAEMON Tools Lite
• WinRAR 5.31 (64-bit)
• The Desktop Weather 2.0
• Shopper-Pro
• FilesFrog Update Checker
• Reload Icons Cache 1.00
• YouTube Accelerator
• Unlocker 1.9.2
• Direct Video Downloader version 2.10
• VDownloader 4.2.1970

This description was published using automated analysis.

Last update 23 June 2016

 

TOP