PUA/RostpayDrvHubInstallerWithBundles PUA/RostpayDrvHubInstallerWithBundles is a detection for an unwanted application. Below are some of its observed characteristics/behaviours: This detection is for an installer observed to have bundled applications.
For this particular detection the main application being bundled along with is a driver installation called Driver Hub Downloader.
This installer was known to make use of a packaging/bundling known as RostPay. The installation would oftentimes involve affecting changes on the user by asking to install some bundles, a few of them have been observed to be: installation of third party browser. installation of third party Security related applications. installation of third party Video Games related applications. During our tests the application as well appears not to have any proper/quick uninstallation.
Below are some illustration of the Installation: Figure 1: Installation Interface. Figure 2: third party Security Related application Installation. Figure 3: third party browser Related application Installation. Figure 4: third party Video Game Related application Installation. Following are some of the near/exact IOCs/file hash associated with this detection: Md5: 5339C13EB6BB7DC69451362162DC46CE Sha256: 823f4e214abda4896e2da27adc47baccc08c3c547b3716aca01249a997a41943
Make sure that your FortiGate/FortiClient system is using the latest AV database.
Quarantine/delete files that are detected and replace infected files with clean backup copies.
