PUA

Should I remove “PUA:Win32/Rostpay”?

Malware Removal

The PUA:Win32/Rostpay is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What PUA:Win32/Rostpay virus can do?

  • Attempts to connect to a dead IP:Port (2 unique times)
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Russian
  • Attempts to identify installed AV products by registry key

Related domains:

api.az-partners.net
apps.identrust.com
isrg.trustid.ocsp.identrust.com
www.drvhub.net

How to determine PUA:Win32/Rostpay?


File Info:

crc32: E595F910
md5: d8b8300661134f6e5aa33d8f982e16bc
name: driver-hub-install.exe
sha1: 515af25b49577dde10a3a1b9b102b63f83441b53
sha256: 09e50adcb811e152081b4233f2a3f34712d8cae59477d73c090d759359b9ec72
sha512: 7dad8add4872ae5abf10b3e2c12622122f264d2d5711b3607fefc9f903355dbdf68e200f2a0ec83e4bfbae332fcf25f9695a369fc8440157c2f8a96e8d3c94ea
ssdeep: 49152:32wBHuj2tNlt+W1C+Ani0JoFrhchcKFjq2y/k4aqdk7T9Ozjd+X2DZX+pKPNdA1A:3nBHuj2/ltbCFi0JohchBq2y/JdkfkzL
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: xa9 2019 ROSTPAY LTD. All rights reserved.
InternalName: DriverHub
FileVersion: 1.8.0.0
ProductName: DriverHub
ProductVersion: 1.8.0.0
FileDescription: DriverHub Installer
Translation: 0x0409 0x04b0

PUA:Win32/Rostpay also known as:

MicroWorld-eScanTrojan.GenericKD.33018735
CAT-QuickHealTrojan.Rostpay
McAfeeArtemis!D8B830066113
CylanceUnsafe
K7AntiVirusAdware ( 0055daa71 )
BitDefenderTrojan.GenericKD.33018735
ESET-NOD32a variant of Win32/Rostpay.F potentially unwanted
RisingPUA.Rostpay!8.10916 (CLOUD)
Ad-AwareTrojan.GenericKD.33018735
EmsisoftTrojan.GenericKD.33018735 (B)
ComodoMalware@#2l5mrnop6u1ji
DrWebProgram.Unwanted.4320
Invinceaheuristic
McAfee-GW-EditionArtemis
FortinetRiskware/Generic_PUA_FB
FireEyeTrojan.GenericKD.33018735
SophosGeneric PUA FB (PUA)
CyrenW32/Application.OXLX-7896
WebrootW32.Adware.Gen
MAXmalware (ai score=87)
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D1F7D36F
MicrosoftPUA:Win32/Rostpay
ALYacTrojan.GenericKD.33018735
VBA32SigRiskware.ROSTPAYLTD
GDataTrojan.GenericKD.33018735
Qihoo-360Generic/Trojan.Generic.d67

How to remove PUA:Win32/Rostpay?

PUA:Win32/Rostpay removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment