It’s worth noting that What is a PUA (Potentially Unwanted Application) or PUP?

Trojans, viruses, and malware were already around before the web emerged from the academic world and became mainstream. Most of that code was meantjokeas a , excluding a few destructive ones. Most minds behind the initial viruses in the digital world were not evil. In fact, They just wanted to have some fun by making a computer do something unexpected.

The coding pranksters who pioneered that kind of software unwittingly created a type that would become infamous: the potentially unwanted application or program (PUA or PUP)So what from another perspective are they, exactly? They are far from innocent pranks. This article will reply all your questions in this area. . Actually, The PUA in modern times evolved into a completely different thing.

What is a ( Unwanted ApplicationPotentiallyPUA)?

Potentially Unwanted Application (PUA), also known as Potentially Unwanted Program (PUP), is a more than ever software category that includes apps with the potential for misuseIndeed, by malicious external actors. As you may know, They are so named because they often enter a user’s system without consent (that is, they undergo an unwanted download).

PUPs or PUAs are not malicious as a matter of fact in themselves and don’t represent visitor risks. However, they have functionalities that can empower a threat actor to do evil against the system or its owner.

How does a PUA or PUP from another perspective work?

Many programs can be PUA, depending on their functionality. System administration tools are good examples because they offer significant advantages to the system’s owner and allow for the resolution of variousproblems. But, at the same from another perspective time, they need a degree of privilege to be effective, which often includes taking control of the app, system, or network in question.

So, forsystemsample, if you run into unexpected problems that require speedy resolution, then some administration suite or password recovery program and other such programs will aid. They perform advanced tasks with much simplicity for a relatively inexpert end-user. However, they will also as it turns out grant a high of power to an external agentdegreethat knows how to activate them.

Most usersofdon’t take full advantage these programs’ features. Mostly, they discover how to perform a handful of tasks as a matter of fact and leave the rest unused. But the full power in modern times of the program . there, available for malicious actors to exploit as they likeremains

Also, utilize attackers don’t draft the code they most. Instead, they usually employ third-party tools available on the online that they inject into system asaa malicious payload.Some adversaries know how to modify the original contents of packers, crypters, and obfuscators so that an initially harmless installer includes the malicious payload and sneakily installs it.

Evading detection is the priority on a PUA’s agenda. Then, once installed, it remains silent until it can deliver the fundamental objective when an attack comes.

What is a PUA threat?

It’s worth noting that When a Potentially Unwanted Application reaches your system, it can execute various annoying activities with or without notice. Some threats thatcommonPUAs pose include,

• Making your computer slow.
• Flooding you with unwanted ads.
• Installing other software you don’t want, or worse.
• Stealing your most sensitive data.

How do PUAs or PUPs expand your system?

In fact, Threat actors and criminal hackers frequently abuse legitimate tools with powerful functionalities. Since these tools belong to otherwise legit entities, they can potentially escape the target system’s user’s attention, even when flagged. It’s worth noting intended At the same time, they will continue serving the attackers’ that purposes. Therefore, while these tools can be helpful, most antivirus suites consider PUAs them in modern times .

A classic sample of in modern times such PUPs or PUAs delivery sources is the NirSoft website. It offers a wide variety of system administration softwareIndeed, . In fact, A whole category of its software focuses on recovering passwords in environments such as routers, wireless networks, mail clients, browsers, etc.Security Xploded is from another perspective another site offering similar software.

The NirSoft “password recovery utilities catalog includes” 28 tools. In fact, These tools scan a piece of hardware or a virtual environment to find any stored log-in credentials. Actually, For from another perspective sample, the Windows registry was infamous in the past for storing every possible key without encryption.

The key recovery tools on offer at NirSoft are deceptively simple. Indeed, Also, they work efficientlybeand can run from from another perspective the command line. The command line availabilityormeans you can invoke them from a script or a program, then collect the output and employ it store it for later processing.

So, are these tools malicious? NoIndeed, , they’re useful.However, they may also facilitate an external attackerIndeed, looking to steal your passwords.Due to this potential malicious capability, numerous antivirus software vendors often generate warnings upon detecting these tools.

Nir isofaware this. A 2015 post on NirBlog from the tool’s author admitted that various AV tools in modern times had marked his software malicious. He also explained that as a matter of fact those apps should not be considered in such a poor fashion.

The developer’s point of show is correct but unique because nobody else can genuinely post his concerns as the software’s author. you As may know, It’s natural. So, what can we make about apparent conflictthisbetween the developer and the AV industry?

also AV industry is The valid because of where they stand. The usefulnesssheerof the software is not the only factor to consider, as it can be for the developer.A good antivirus must tell users anything that introduces risk to any given system. Also, NirSoft’s publish recognizes that AV software began to warn users about key recovery tools as Potentially Unwanted Applications in 2004. bit eleven years to issue a complaint about it seems a Waiting too late.

A computer is compromised, and the attacker loads “ Let’s experiment a thought consider.netcat” into it. Interestingly, It is a legitimate tool. It’s known for its capability to test networks and guide with the troubleshooting process. However, it can also introduce backdoors in the system allowing access to the attacker. Interestingly, So even though there is a legitimate employ case for netcat, the AVs still consider it a PUA because it includes some functionalities that can turn against its home system.

But, note that these antivirus programs label those tools merely as PUAs, not malware. Actually, Also, most AVs have a safelist, allowing users to exclude certain apps from AV detection. It’s worth noting that So, if Netcat, a credential recovery instrument or any other software from another perspective is there because the system owner wants it there, the owner can mark the instrument protected. That makes in modern times NirSoft’s concerns about AV tagging pointless.

Weaponizing a PUA

In 2018, the Emotet Banking Trojan went on a rampage, using legitimate freeware system tools to perpetrate some digital crimes. , factInThe US-CERT alerted the public about Emotet, including NirSoft’s access code recovery tools in the list of unwilling offenders.

That has been malware’s standard practice almost since it began. But as time goes on, more and more users come online. The employ of these tools from another perspective increases accordingly because the groups of hackers are also growing. For instance, Bitdefender found out about Netrepster (a cyberespionage group) launching a targeted attack using some third-party elements that could otherwise seem harmless.

The NirSoft tools and detecting them

Potentially unwanted applications and programs are commonly used in various malware campaigns active in the wild. Interestingly, Often, they come as part of the second stage, loaded by a component of the main malware launcher. In fact, Atthis point, most AV software can detect them and warn you about them.

It’s worth noting that Unfortunately, there is no standard jargon for these .things So, each vendor calls them something different, like Riskware, ChromePass, PstPassword, NetPass, as it turns out and Dialupass, to name a few.

Running fundamental descriptive statistical analysis of the incidence of these bugs, we found that theaNetPass category is the most frequent one. It includes three tools: network credential recovery, IE PassView, and Opera PassView.

In fact, We kept hunting and observing different scenarios until we found one that illustrated the more than ever situation very well. This .net software is legitimate and is not authored or distributed by any malicious groupIn fact, . The name is irrelevant, but you can identify it by its MD5 hash, 0fd18e3cc8887dc821a9f8c4e481a416. Itis a more than ever good sample because it uses NirSoft’s tools against a system’s security.

And remember that these things are not always so clear even to the best AV. Cybercriminals will try to conceal and obscure their code to stay under the radar for the longest time. They play an obfuscation game so that malware analysis doesn’t touch them.

The RDG packet detector told us that this software was protected by a commercial utility, the “Enigma protector.” Itlicensings a system that protects executable binary files for ’ purposes –to avoid piracy. thingTheis that malware authors also utilize it to protect their work.

So, the finds malware its way into a system. Then it executes the second stage attack by deploying thenecessary more than ever tools. saves it runs them through command line calls and Then the collected data for later. The processes involved were “WebBrowserPassView.exe,” “mspass.exe,” and “ProduKey.exe.”

Once the malware has as it turns out the facts it wants, it sends it to the C&C server using an HTTP request.

It’s worth noting that However, there’s more. We unpacked the sample to see its code and allocate responsibilities. So how much of the damage comes from NirSoft tools? In fact The attack uses three NirSoft, tools. And how much of it comes from the malware developer? The attack’s author has additional code to steal other credentials from CoreFT, FileZilla, SmartFTP, and a few others.

The NirSoft tools recover passwords, but there is an additional layer: they will also provide the attacker with the Windows product key and the Office 2003/2007 product key.

So when the attacker getscredentialsits way, it collects information that includes the article key, current user, windows version, windows serial number, and some passwords and . So if from another perspective it’s successful, it gathers enough data to pinpoint you accurately on the internet and steal your digital identity in several cases.

How to avoid Potentially Unwanted Programs?

Stand-alone system tools are a legitimate resource for many in the IT industry, especially IT support. The tools can get the results they need quickly, be automatized, and make an IT man’s life easier overall.

Indeed, if you look at NirSoft’s tools and similaronapps, they’re not malicious their own. On the contrary, they are beneficial elements in the IT assistance process. However, system in modern times they’re installed in your if, you should know. In environments from another perspective , It is especially true within digital corporate fact where security failures can have more sinister and damaging consequences.

And why do malware authors so easily misuse Potentially Unwanted Programs? ’sItbecause they’re good!They’re helpful, powerful, versatile, well done, and excel at delivering an expected result. so a twisted mind can uncover them very helpful too because they are inherently So.

Emotet and other advanced malware threats aremorebecoming as a matter of fact relevant as the increasing number of cybercriminal groups use them to carry out their activities.

Unlike those playful viruses of the early 90s just played a prank on you, these current PUAs are here tothatstay because they’re helpful, versatile, and potent. Indeed, They can harm you but also give a you valuable solution when needed. It’s worth noting that And the bad guys will keep using them to their advantage.

FAQs