Potentially Unwanted Applications (PUAs) continue to visually social engineer users into installing virtually useless applications. They monetize each and every install by relying on ‘bundling’ which often comes in the form of a privacy-violating toolbar or third-party application. We recently intercepted a rogue ad that entices users into downloading the Mipony Download Accelerator that is bundled with the privacy-invading FunMoods toolbar PUA, an unnecessary bargain with the integrity and confidentiality of your PC.
Sample screenshot of the landing page:
Detection rate for the PUA: MD5: 023e625cbb1b30565d46f7533ddc03db – detected by 6 out of 47 antivirus scanners as W32/InstallCore.R4.gen!Eldorado; Install Core Click run software.
Domain name reconnaissance: ultimatedownloadaccelerator.com – 50.19.220.248; 174.129.22.118; 23.21.144.61; 23.23.144.245
Upon execution, it phones back to:
cdneu.ultimatedownloadaccelerator.com – 65.254.40.36
os-test.ultimatedownloadaccelerator.com – 54.244.230.64
cdnus.ultimatedownloadaccelerator.com – 199.58.87.155
img.ultimatedownloadaccelerator.com – 199.58.87.155
Related MD5s part of the same network that are known to have been downloaded from the same IPs, over the last couple of days:
MD5: caa5e691d1eddef66294d1323720556e
MD5: 88ba249e0fac7ece69e8a769ec9e81dc
MD5: 748346dc2138aa4927e2ad577c0a97c8
MD5: 78b98bbec669999bd51f7f408d06d9f6
MD5: 7ee56be08401efbc443c286dce641bd6
MD5: 0a6836e3f26e4be1654b18f84191985a
MD5: 3822e38b95cde512aa5a11dc21cd2699
MD5: 2cc18f48633788894e505eaa7b11f6bf
MD5: 02f5346e1ee415de637458be66eb319e
MD5: cdddec958148633578b0574d6551facd
MD5: bc276e312294916fc748937b9e9a6423
MD5: de146519fb5ffe3c5bee07f49ebd0907
MD5: 2d28af1f6bf5115532c19010edbdd463
MD5: df2181cf0b55eebf0f281562314740b1
MD5: 0a6fdc3ecb5da97038df8b28bfaf9581
MD5: df2181cf0b55eebf0f281562314740b1
MD5: 0a6fdc3ecb5da97038df8b28bfaf9581
MD5: 1cd458a9181e1c30cb2b28efd29075cd
MD5: f5976b181cde557f620578eb92535ac7
MD5: b2a7fad9f3f892577d876c74cb221525
MD5: f1242926095907cebd741d8d540567b0
MD5: 2e60e85bfaf1175c2e7ed0390b09ee67
Detection rate for the FunMoods Toolbar: MD5: 592f35f9954a7ec4c0b4985857f81ad8 – detected by 13 out of 48 antivirus scanners as Win32/InstallCore; PUP.Optional.Funmoods
Once executed, it phones back to:
os.funmoodscdn.com (54.245.235.34)
cdneu.funmoodscdn.com (146.185.27.53)
cdnus.funmoodscdn.com (199.58.87.155)
Known to have responded to the same IPs, are also the following domains part of the same infrastructure:
os-test.anymusicconverter.com
os-test.coolpdfcreator.com
os-test.extrimdownloadmanager.com
os-test.greataudioconverter.com
os-test.thebestallcodecsapp.com
os-test.thebestcodecpackapp.com
os-test.thebestimageeditorfunapp.com
os-test.thecoolzipextractorapp.com
os-test.thedownloadmanagerapp.com
os-test.thenewzipopenerfun.com
os-test.thepdfcreatorapp.com
os-test.thevideoconverterexclusive.com
os-test.ultimatedownloadaccelerator.com
os-test.unipdfconverter.com
os.50orcdn.com
os.5oftwarescdn.com
os.abiwordapp.com
os.adsearchescdn.com
os.afdlcdn.com
os.afreecodeccdn.com
cdneu.50orcdn.com
cdneu.5oftwarescdn.com
cdneu.adsearchescdn.com
cdneu.afdlcdn.com
cdneu.alcoholsoftcdn.com
cdneu.allmyappscdn.com
cdneu.amazingwebtvcdn.com
cdneu.amniscdn.com
cdneu.anymusicconverter.com
cdneu.anyprotectcdn.com
cdneu.anysendapp.com
cdneu.apponiccdn.com
cdneu.appzeuscdn.com
cdneu.aviracdn.com
cdneu.baixakialtcdn.com
cdneu.baixakialtcdn2.com
2cdneu.baixakicdn.com
cdneu.bestflvplayer.net
cdneu.bestringtonesmaker.com
cdneu.bestvistadownloadscdn.com
Despite the fact that most modern day PUAs include uninstall instructions, our advice is to not install them in the first place, instead, seek a legitimate — often free but this time fully featured and working — alternative to their pseudo-unique value propositions.
Webroot SecureAnywhere users are proactively protected from these PUAs.
