Categories: PUA

Should I remove “PUA:Win32/Rostpay”?

The PUA:Win32/Rostpay is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/Rostpay virus can do?

Attempts to connect to a dead IP:Port (2 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Performs some HTTP requests
Unconventionial language used in binary resources: Russian
Attempts to identify installed AV products by registry key

Related domains:

api.az-partners.net

apps.identrust.com

isrg.trustid.ocsp.identrust.com

www.drvhub.net

How to determine PUA:Win32/Rostpay?


File Info:
crc32: E595F910md5: d8b8300661134f6e5aa33d8f982e16bcname: driver-hub-install.exesha1: 515af25b49577dde10a3a1b9b102b63f83441b53sha256: 09e50adcb811e152081b4233f2a3f34712d8cae59477d73c090d759359b9ec72sha512: 7dad8add4872ae5abf10b3e2c12622122f264d2d5711b3607fefc9f903355dbdf68e200f2a0ec83e4bfbae332fcf25f9695a369fc8440157c2f8a96e8d3c94eassdeep: 49152:32wBHuj2tNlt+W1C+Ani0JoFrhchcKFjq2y/k4aqdk7T9Ozjd+X2DZX+pKPNdA1A:3nBHuj2/ltbCFi0JohchBq2y/JdkfkzLtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: xa9 2019 ROSTPAY LTD. All rights reserved.InternalName: DriverHubFileVersion: 1.8.0.0ProductName: DriverHubProductVersion: 1.8.0.0FileDescription: DriverHub InstallerTranslation: 0x0409 0x04b0

PUA:Win32/Rostpay also known as:

MicroWorld-eScan	Trojan.GenericKD.33018735
CAT-QuickHeal	Trojan.Rostpay
McAfee	Artemis!D8B830066113
Cylance	Unsafe
K7AntiVirus	Adware ( 0055daa71 )
BitDefender	Trojan.GenericKD.33018735
ESET-NOD32	a variant of Win32/Rostpay.F potentially unwanted
Rising	PUA.Rostpay!8.10916 (CLOUD)
Ad-Aware	Trojan.GenericKD.33018735
Emsisoft	Trojan.GenericKD.33018735 (B)
Comodo	Malware@#2l5mrnop6u1ji
DrWeb	Program.Unwanted.4320
Invincea	heuristic
McAfee-GW-Edition	Artemis
Fortinet	Riskware/Generic_PUA_FB
FireEye	Trojan.GenericKD.33018735
Sophos	Generic PUA FB (PUA)
Cyren	W32/Application.OXLX-7896
Webroot	W32.Adware.Gen
MAX	malware (ai score=87)
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D1F7D36F
Microsoft	PUA:Win32/Rostpay
ALYac	Trojan.GenericKD.33018735
VBA32	SigRiskware.ROSTPAYLTD
GData	Trojan.GenericKD.33018735
Qihoo-360	Generic/Trojan.Generic.d67