Do you know what Gelup is?
Gelup is a new malware downloader that was discovered running in the wild. This infection is spread using spam campaigns, and it appears to be currently targeted at larger organizations in the Middle East, as well as India, Japan, Philippines, and Argentina. This malware is all over the place, and this is not good news, as there is a good possibility that it could spread even more and start targeting vulnerable systems in more countries. Right now, however, it is most dangerous to those living in the mentioned regions. Without a doubt, if this threat has not reached your system yet, it is important to secure it, and it is most important that you are cautious with the emails you receive. If you have figured out by now that you need to remove Gelup from your operating system, please continue reading.
Our research team identifies Gelup as DangerousObject.Generic, and it is important to mention one other dangerous threat called FlowerPippi when discussing it. This threat is a backdoor, and it is possible that both of them will work hand in hand. This malware could enter your vulnerable operating system in many different ways, but, at the moment, it is most likely to exploit emails. In many cases, the malicious FlawedAmmyy downloader is involved, and it makes the execution of Gelup easier. The email message, of course, is misleading, and it is meant to trick you into thinking that clicking an attachment sent along with the message is not dangerous at all. Amongst the discovered emails, .DOC, .HTML and .XLS files were used as bait in most cases, and they could be presented as attachments or get downloaded via the included links. If the victim was tricked into opening the attachment, downloading the file, and enabling macros, the FlawedAmmyy downloader was executed, and then the malicious payload was downloaded.
According to our malware research team, Gelup works as payload downloader, and that means that it can be used to download anything that the attackers need. It was also found that the infection can record some user information that, of course, is sent to a remote C&C server for analysis. Gelup is a unique infection is a sense that it can bypass User Account Control (UAC), abuse auto-elevated .exe files, and exploit the dynamic-link library. Without a doubt, it is a serious weapon in the hands of cyber criminals, and it is important to remove it from any affected system as soon as possible. The problem is that if you need to delete this downloader from your system, the chances are that there are plenty of other threats that require your attention as well. Therefore, before you commence removal, we suggest that you scan your operating system using a reliable malware scanner.
Once you know what exactly it is that you are dealing with, you can create a plan that will help you clean and protect your operating system the best. Whether you need to delete Gelup alone or along with multiple other threats, it is best to implement anti-malware software that is capable of eliminating all existing threats automatically. You also can use this software to protect your operating system against other dangerous infections and cyber attackers in the future. You will have to figure out the removal of additional threats and your system’s security yourself if you decide to remove Gelup manually, which, hopefully, you can do by following the instructions below.
Remove Gelup
- Launch Windows Explorer (tap Win+E keys).
- Enter %ALLUSERSPROFILE% into the quick access field.
- Delete the malicious {random name}.exe file.
- Enter %APPDATA% into the quick access field.
- Delete the folder named MSOCache.
- Launch Run (tap Win+R keys).
- Enter regedit into the box to access Registry Editor.
- Delete the malicious {random name} value linked to the %ALLUSERSPROFILE%\{random name}.exe file in these directories:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Close all windows and immediately Empty Recycle Bin.
- Perform a full system scan using a reliable and legitimate malware scanner.
In non-techie terms:
Gelup is a Trojan that can slither into your operating system via a malicious email message without your notice. After that, it is set to download malicious payload on command, as well as record and transfer some information about you to remote attackers. Most likely, this infection was created to target larger organizations with a network of interlinked computers, but we cannot refute the possibility that this threat could invade the systems of random users too. Once inside, this infection can create big security issues, and that is why it is important to protect your system against it. If you have already confirmed that you need to delete Gelup from your system, do not just assume that no other threats exist. In fact, it is most likely that you need to remove a bunch of other threats. Due to this, it is a good idea to install an automated anti-malware program. If you think you can handle all infections on your own, start by deleting the Trojan using the manual removal guide above.