Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ucul.exe
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Full path to file>"
Modifies file system:
Creates the following files:
- %TEMP%\1.tmp\cu.jpg
- %TEMP%\1.tmp\ho1.jpg
- %TEMP%\1.tmp\2.bau.lisensi
- %TEMP%\1.tmp\goy.jpg
- %TEMP%\1.tmp\Bapa LAgi.txt
- %TEMP%\1.tmp\2.bat
- %TEMP%\1.tmp\hg4lkls-OP.png
- %TEMP%\1.tmp\Bpk9 Carole Branfreth.txt
Deletes the following files:
- %TEMP%\1.tmp\goy.jpg
- %TEMP%\1.tmp\cu.jpg
- %TEMP%\1.tmp\2.bat
- %TEMP%\1.tmp\2.bau.lisensi
- %TEMP%\1.tmp\Bpk9 Carole Branfreth.txt
- %TEMP%\1.tmp\Bapa LAgi.txt
- %TEMP%\1.tmp\ho1.jpg
- %TEMP%\1.tmp\hg4lkls-OP.png
