» DrvUpdater.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (2)
Network (8)

DrvUpdater.exe

DRP Su Updater

Kuzyakov Artur Vyacheslavovich IP

The application DrvUpdater.exe by Kuzyakov Artur Vyacheslavovich IP has been detected as a potentially unwanted program by 9 anti-malware scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘DrvUpdater’. Additionally, the file is typically installed by a number of programs including DriverPack Solution Updater by DriverPack Solution and Convenient shortcuts by Kuzyakov Artur Vyacheslavovich IP. While running, it connects to the Internet address 217-160-0-39.elastic-ssl.ui-r.com on port 80 using the HTTP protocol.

File name:

DrvUpdater.exe

Publisher:

Kuzyakov Artur Vyacheslavovich IP (signed and verified)

Product:

DRP Su Updater

Version:

0, 0, 25, 0

MD5:

1db3300fe6ef0d52ecabbb903fca6a41

SHA-1:

d5bc16779827e1cd0bb6d7dc652cdee40c0b9bac

SHA-256:

574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25

Scanner detections:

9 / 68

Status:

Potentially unwanted

Analysis date:

4/24/2024 1:13:56 AM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

Win32/Kashu.E

2014.07.11

avast!

Win32:Sality

2014.9-140928

K7 AntiVirus

Virus

13.180.12683

Microsoft Security Essentials

Threat.Undefined

1.177.2145.0

Norman

Sality.ZHB

11.20140928

Qihoo 360 Security

Malware.QVM19.Gen

1.0.0.1015

Reason Heuristics

PUP.Startup.KuzyakovArturVyacheslavovichIP.K

14.3.19.23

Trend Micro

PE_SALITY.ER

10.465.28

VIPRE Antivirus

Threat.4758034

31088

File size:

190.7 KB (195,256 bytes)

Product version:

0, 0, 25, 0

DriverPack Solution

Original file name:

DrvUpdater.exe

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\appdata\roaming\drpsu\drvupdater.exe

Digital Signature

Signed by:

Kuzyakov Artur Vyacheslavovich IP

Authority:

COMODO CA Limited

Valid from:

2/28/2012 3:00:00 AM

Valid to:

2/28/2015 2:59:59 AM

Subject:

CN=Kuzyakov Artur Vyacheslavovich IP, O=Kuzyakov Artur Vyacheslavovich IP, STREET=24K1 Tashkentskaya ul., L=Moscow, S=Moscow, PostalCode=109472, C=RU

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

008ED5EE3D985B31936DA24E4A4CC34419

File PE Metadata

Compilation timestamp:

4/28/2011 11:25:13 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

3072:Qj52RXf17lQSfIR08uBlCfsUaJAgtpl+xu+QXGOw07mEiEo+C9eIT6RfbtDw9ouk:QdGvgKIR08uBlCfVOAIpl+4vcHz9ek6R

Entry address:

0x65BA0

Entry point:

60, BE, 00, F0, 43, 00, 8D, BE, 00, 20, FC, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 75, 33, 06, 00, 57, 83, C3, 04, 53, 68, 9B, 6B, 02, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 00, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A... 
[+]

Entropy:

7.8818 (probably packed)

Code size:

160 KB (163,840 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

DrvUpdater

Command:

C:\users\{user}\appdata\roaming\drpsu\drvupdater.exe \hide

The file DrvUpdater.exe has been discovered within the following programs.

Convenient shortcuts by Kuzyakov Artur Vyacheslavovich IP

49% remove it

DriverPack Solution Updater by DriverPack Solution

DriverPack Solution Updater is the updater program which runs with Windows (in the background as a service) and automatically starts up when your computer boots. It checks for updates and automatically downloads and installs them if found based on the user's settings.

56% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to srv2.ampyazilim.com.tr (37.230.104.89:80)

TCP (HTTP):

Connects to server123.managedns.org (103.14.97.123:80)

TCP (HTTP):

Connects to apache2-yak.zarniwoop.dreamhost.com (173.236.154.78:80)

TCP (HTTP):

Connects to CHHOSTW03.net4.com (118.67.248.123:80)

TCP (HTTP):

Connects to box383.bluehost.com (69.89.31.183:80)

TCP (HTTP):

Connects to 93-89-226-17.fbs.com.tr (93.89.226.17:80)

TCP (HTTP):

Connects to 217-160-0-4.elastic-ssl.ui-r.com (217.160.0.4:80)

TCP (HTTP):

Connects to 217-160-0-39.elastic-ssl.ui-r.com (217.160.0.39:80)

Remove DrvUpdater.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.