Categories: PUA

PUA:Win32/Somoto (file analysis)

The PUA:Win32/Somoto is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/Somoto virus can do?

Attempts to connect to a dead IP:Port (2 unique times)
Presents an Authenticode digital signature
A process attempted to delay the analysis task.
Reads data out of its own binary image
Drops a binary and executes it
Performs some HTTP requests
Anomalous binary characteristics

Related domains:

installer.filebulldog.com

flbktrk.com

How to determine PUA:Win32/Somoto?


File Info:
crc32: 16D3933Amd5: e0919151b60d3f39ef0a5cf10714559dname: mdrsetup.exesha1: bc83ce8d1a136de7e009a4f4888c9bf9f8e2378bsha256: 96df4b1dadf61cb32cb50159a29e45092e8368b9ab9dee36cd884d5569050271sha512: 24b364ba2dda8894bf2ff8e85fedca8b2c328c2374f9bb89a0ee398e0e64d63510cb0c09a03b296b799ad2355e4da35e4652386384497c5e8b685ddea1d9dc47ssdeep: 3072:y22ihA0m3BJP0A/m+w533nBHxZ1ENWtsMV2kJO:tA0m3D0A/HKBHuYt5Vrctype: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Version Info:
LegalCopyright: FileVersion: 1.2.0.0CompanyName: ProductName: ProductVersion: FileDescription: Powered by BetterInstallerTranslation: 0x0000 0x04e4

PUA:Win32/Somoto also known as:

Bkav	W32.HfsAdware.71E9
MicroWorld-eScan	Dropped:Application.Bundler.Somoto.AJ
FireEye	Generic.mg.e0919151b60d3f39
CAT-QuickHeal	PUA.Somotoltd.Gen
Cylance	Unsafe
Zillya	Adware.SomotoCRTD.Win32.24
K7AntiVirus	Unwanted-Program ( 004a9cec1 )
BitDefender	Dropped:Application.Bundler.Somoto.AJ
K7GW	Unwanted-Program ( 004a9cec1 )
Cybereason	malicious.1b60d3
Invincea	heuristic
F-Prot	W32/Somoto.A!Eldorado
TotalDefense	Win32/Somoto.YGHNfSB
APEX	Malicious
Avast	Win32:Somoto-B [PUP]
ClamAV	Win.Adware.Somoto-4
GData	Win32.Application.Somoto.AA
Kaspersky	not-a-virus:Downloader.Win32.Somato.ax
Alibaba	Downloader:Win32/Somato.285caa36
NANO-Antivirus	Trojan.Win32.Adw.fcgbbl
ViRobot	Adware.Somoto.158144.CD
Endgame	malicious (high confidence)
Emsisoft	Application.Downloader (A)
Comodo	Application.Win32.Somoto.A@52gqm7
F-Secure	PotentialRisk.PUA/Somoto.Gen2
DrWeb	Adware.Somoto.8
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	ADW_TOMOS.SMN
MaxSecure	Not.a.virus.Trojan.BetterInstaller
Sophos	Somoto BetterInstaller (PUA)
Ikarus	PUA.Somoto
Cyren	W32/Somoto.A!Eldorado
Jiangmin	AdWare/BetterInternet.lp
Webroot	Pua.Adware.Somoto
Avira	PUA/Somoto.Gen2
Antiy-AVL	GrayWare[AdWare]/Win32.Somoto.a
Microsoft	PUA:Win32/Somoto
Arcabit	Application.Bundler.Somoto.AJ
SUPERAntiSpyware	Adware.Somoto/Variant
ZoneAlarm	not-a-virus:Downloader.Win32.Somato.ax
TACHYON	Trojan-Clicker/W32.BetterInternet.158144
AhnLab-V3	Win-PUP/Somoto.X1372
VBA32	Adware.Presenoker
MAX	malware (ai score=73)
Ad-Aware	Dropped:Application.Bundler.Somoto.AJ
Malwarebytes	PUP.Optional.Somoto
Panda	PUP/MultiToolbar.A
Zoner	Trojan.Win32.49236
ESET-NOD32	a variant of Win32/Somoto.A potentially unwanted
TrendMicro-HouseCall	ADW_TOMOS.SMN
Yandex	PUA.Somoto!
SentinelOne	DFI – Malicious PE
eGambit	Generic.Malware
Fortinet	Riskware/Somoto
AVG	Win32:Somoto-B [PUP]
CrowdStrike	win/malicious_confidence_100% (D)