Malware Analysis of PUP.Optional.Amigo – OLD_AMIGO.EXE

Created files:

%Local Appdata%\Amigo\Application\mm.exe
%Local Appdata%\Amigo\Application\ok.exe
%Local Appdata%\Amigo\Application\old_amigo.exe
%Local Appdata%\Amigo\Application\VisualElementsManifest.xml
%Local Appdata%\Amigo\Application\vk.exe

Autostart registry keys:

HKLM\Software\Classes\CLSID\{14F4B774-7A5C-4DA0-9F38-94F695DC11BF}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{665FF171-3952-44A4-8ACF-73112F083EBA}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32\: “%Local Appdata%\Mail.Ru\Sputnik\IESearchPlugin.dll”
HKLM\Software\Classes\CLSID\{90B76222-AF99-4CEF-A184-A01F910B4B8E}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{B43ED7B8-FD23-4332-B6EC-ADEF7F217592}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{D8379725-3B2F-4283-B754-5EE2DE2ADB86}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{DD81E8DB-AD66-43C0-8600-F6C26C928A5A}\InprocServer32\: “%Program Files%\Note-up\noteupshell0.dll”
HKLM\Software\Classes\CLSID\{FD15BD60-7777-4E7E-AB46-4AD7BB299BFB}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{FD2F9534-54A2-4B40-9C0B-35EF21ECAF5A}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\AmigoHTML.NARYC4MAR452DWMECJZECYNNAA\shell\open\command\: “”%Local Appdata%\Amigo\Application\amigo.exe” — “%1″”
HKLM\Software\Classes\KometaHTM.NARYC4MAR452DWMECJZECYNNAA\shell\open\command\: “”%Local Appdata%\Kometa\Application\kometa.exe” — “%1″”
HKLM\Software\Clients\StartMenuInternet\amigo.exe\shell\open\command\: “”%Local Appdata%\Amigo\Application\amigo.exe””
HKLM\Software\Clients\StartMenuInternet\Amigo.NARYC4MAR452DWMECJZECYNNAA\shell\open\command\: “”%Local Appdata%\Amigo\Application\amigo.exe””
HKLM\Software\Clients\StartMenuInternet\kometa.exe\shell\open\command\: “”%Local Appdata%\Kometa\Application\kometa.exe””
HKLM\Software\Clients\StartMenuInternet\Kometa.NARYC4MAR452DWMECJZECYNNAA\shell\open\command\: “”%Local Appdata%\Kometa\Application\kometa.exe””
HKLM\Software\Google\Chrome\Extensions\nbifdkmdojgmpmopdebnjcobekgdoncn\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Google\Chrome\Extensions\bpgangmffjcofiknibcmfjionicohfgj\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Google\Chrome\Extensions\bgbgnhmfbcifpkjofoojfplmfkmaiadn\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\VSProtector: “%Program Files%\Visual Protect Service\VSProtector.exe /schema=altv /partner=1445081218”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Note-up: “%Program Files%\Note-up\note-up.exe /watch”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Note-up\DisplayName: “Note-up”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Note-up\UninstallString: “%Program Files%\Note-up\uninstall.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\NUIns\DisplayName: “Note-UP”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\NUIns\UninstallString: “”%Appdata%\NUIns\Uninstall.exe””
HKLM\System\CurrentControlSet\Services\gamexpsvc\ImagePath: “”%Program Files%\GameXPService\gamexpsvc.exe””
HKLM\System\CurrentControlSet\Services\gamexpsvc\DisplayName: “GameXP Service”
HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru\ImagePath: “%Program Files%\Mail.Ru\MailRuUpdater\MailRuUpdater.exe –s”
HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru\DisplayName: “Updater.Mail.Ru”
HKLM\System\CurrentControlSet\Services\VSProtectProxy\ImagePath: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\System\CurrentControlSet\Services\VSProtectProxy\DisplayName: “VSProtectProxy”
HKLM\System\CurrentControlSet\Services\VSUpdater\ImagePath: “%Program Files%\VideoDownloader\VSUpdater.exe –service”
HKLM\System\CurrentControlSet\Services\VSUpdater\DisplayName: “Visual Proctect Updater”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyDesktop: “%Appdata%\MyDesktop\linkme.exe /killme_99 /restoreme_99 /url_ru”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\GameXP AccessPoint: “”C:\GameXP\AccessPoint\accesspoint.exe” -silent”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MailRuUpdater: “%Local Appdata%\Mail.Ru\MailRuUpdater.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\KometaLaunchPanel: “%Local Appdata%\Kometa\Panel\KometaLaunchPanel.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\amigo: “%Local Appdata%\Amigo\Application\amigo.exe –no-startup-window”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\UninstallString: “%Local Appdata%\Unity\WebPlayer\Uninstall.exe /CurrentUser”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\DisplayName: “Unity Web Player”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater\UninstallString: “%Local Appdata%\Mail.Ru\MailRuUpdater.exe uninstall”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\KometaLaunchPanel\UninstallString: “”%Local Appdata%\Kometa\Panel\1.0.0.763\panelremove.exe””
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Kometa\DisplayName: “Kometa”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Kometa\UninstallString: “”%Local Appdata%\Kometa\Application\45.0.2454.101\Installer\setup.exe” –uninstall”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo\DisplayName: “Amigo”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo\UninstallString: “”%Local Appdata%\Amigo\Application\42.0.2311.254\Installer\setup.exe” –uninstall”
HKCU\Software\Amigo\UninstallString: “%Local Appdata%\Amigo\Application\42.0.2311.254\Installer\setup.exe”
HKCU\Software\NetBox\Kometa\UninstallString: “%Local Appdata%\Kometa\Application\45.0.2454.101\Installer\setup.exe”

Detected by UnHackMe:

OLD_AMIGO.EXE
Default location: %LOCAL APPDATA%\AMIGO\APPLICATION\OLD_AMIGO.EXE

Dropper hash(md5): 7a69a52bff1f0422b78b22c222123a26

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.