Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\UltraViewService] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\UltraViewService] 'ImagePath' = '"C:\UltraViewer\UltraViewer_Service.exe"'
Modifies file system:
Creates the following files:
- C:\UltraViewer\Referral.ini
- C:\UltraViewer\images\emotions\robot.png
- C:\UltraViewer\images\emotions\shark.png
- C:\UltraViewer\images\emotions\smile.png
- C:\UltraViewer\images\emotions\squint.png
- C:\UltraViewer\images\emotions\sunglasses.png
- C:\UltraViewer\images\emotions\surprised.png
- C:\UltraViewer\images\emotions\thumb-up.png
- C:\UltraViewer\images\emotions\tongue-out.png
- C:\UltraViewer\images\emotions\unsure.png
- C:\UltraViewer\images\emotions\wink.png
- C:\UltraViewer\images\loading.gif
- C:\UltraViewer\images\minimize_icon.png
- C:\UltraViewer\images\online.png
- %TEMP%\jquery-1.9.1.js
- C:\UltraViewer\images\restore_icon.png
- C:\UltraViewer\Language\English.txt
- C:\UltraViewer\Language\LanguageList.ini
- C:\UltraViewer\Language\Vietnamese.txt
- C:\UltraViewer\emotion.fan
- C:\UltraViewer\HtmlAgilityPack.dll
- C:\UltraViewer\HtmlAgilityPack.tlb
- C:\UltraViewer\Language.ini
- C:\UltraViewer\msvbvm60.dll
- %TEMP%\clientlist.html
- %TEMP%\remoterlist.html
- %TEMP%\chatlog.html
- C:\UltraViewer\images\emotions\poop.png
- C:\UltraViewer\images\offline.png
- C:\UltraViewer\images\emotions\penguin.png
- C:\UltraViewer\images\close-icon.png
- C:\UltraViewer\RemoteControl40.dll
- C:\UltraViewer\RemoteControl40.tlb
- C:\UltraViewer\RemoteControl.dll
- C:\UltraViewer\RemoteControl.tlb
- C:\UltraViewer\UltraViewer_Desktop.exe
- C:\UltraViewer\UltraViewer_Desktop.exe.config
- C:\UltraViewer\UltraViewer_Service.exe
- C:\UltraViewer\UltraViewer_Service.exe.config
- C:\UltraViewer\unins000.dat
- C:\UltraViewer\unins000.exe
- C:\UltraViewer\Ver.reg
- C:\UltraViewer\RUN_UltraViewer.exe
- C:\UltraViewer\images\comment_dots.png
- C:\UltraViewer\images\emotions\kiss.png
- C:\UltraViewer\images\emotions\angel.png
- C:\UltraViewer\images\emotions\angry.png
- C:\UltraViewer\images\emotions\big-smile.png
- C:\UltraViewer\images\emotions\confused.png
- C:\UltraViewer\images\emotions\crying.png
- C:\UltraViewer\images\emotions\curly-lips.png
- C:\UltraViewer\images\emotions\devil.png
- C:\UltraViewer\images\emotions\frown.png
- C:\UltraViewer\images\emotions\glasses.png
- C:\UltraViewer\images\emotions\grumpy.png
- C:\UltraViewer\images\emotions\heart.png
- C:\UltraViewer\images\emotions\kiki.png
- C:\UltraViewer\images\emotions\pacman.png
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\wpad[1].cache
Deletes the following files:
- %TEMP%\remoterlist.html
- %TEMP%\chatlog.html
- %TEMP%\clientlist.html
Network activity:
Connects to:
- 'wp#d':80
- 'fu######s.ultraviewer.net':443
- 'fu######s2.ultraviewer.net':443
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK fu######s.ultraviewer.net
- DNS ASK fu######s2.ultraviewer.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Static' WindowName: 'GDI+Safe Patch'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- 'C:\UltraViewer\RUN_UltraViewer.exe'
- 'C:\UltraViewer\UltraViewer_Desktop.exe'
- 'C:\UltraViewer\UltraViewer_Service.exe'
- 'C:\UltraViewer\UltraViewer_Desktop.exe' 131314
Executes the following:
- '%WINDIR%\regedit.exe' /S C:\UltraViewer\Ver.reg
- '%WINDIR%\regedit.exe' /S C:\UltraViewer\Ver7.reg
