Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /im update.exe /f
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Searches for windows to
detect analytical utilities:
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Universal Desktop Ruler\Universal Desktop Ruler.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Universal Desktop Ruler\Other AVPSoft.com tools\APBackUp.url
- %ALLUSERSPROFILE%\Start Menu\Programs\Universal Desktop Ruler\Other AVPSoft.com tools\APFill Ink&Toner Coverage Meter.url
- %ProgramFiles%\Universal Desktop Ruler\is-7B7F0.tmp
- %ProgramFiles%\Universal Desktop Ruler\is-RSKV5.tmp
- %ProgramFiles%\Universal Desktop Ruler\is-82399.tmp
- %HOMEPATH%\Desktop\Universal Desktop Ruler.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Universal Desktop Ruler\Uninstall.lnk
- %ProgramFiles%\Universal Desktop Ruler\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\Universal Desktop Ruler\Order Universal Desktop Ruler Now!.url
- %ALLUSERSPROFILE%\Start Menu\Programs\Universal Desktop Ruler\User's technical support forum.url
- %ALLUSERSPROFILE%\Start Menu\Programs\Universal Desktop Ruler\Help.lnk
- %ProgramFiles%\Universal Desktop Ruler\is-1H8N0.tmp
- %TEMP%\update.exe
- %TEMP%\is-14REJ.tmp\udruler.tmp
- %TEMP%\is-N3RKF.tmp\_isetup\_shfoldr.dll
- %TEMP%\aut1.tmp
- %TEMP%\udruler.exe
- %TEMP%\aut2.tmp
- %ProgramFiles%\Universal Desktop Ruler\is-7BHDI.tmp
- %ProgramFiles%\Universal Desktop Ruler\is-1LM51.tmp
- %ProgramFiles%\Universal Desktop Ruler\is-E1M7L.tmp
- %ProgramFiles%\Universal Desktop Ruler\is-41J4I.tmp
- %ProgramFiles%\Universal Desktop Ruler\is-ILOM8.tmp
- %ProgramFiles%\Universal Desktop Ruler\is-71CKU.tmp
Deletes the following files:
- %TEMP%\is-N3RKF.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-14REJ.tmp\udruler.tmp
- %ProgramFiles%\Universal Desktop Ruler\README.TXT
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
Moves the following files:
- from %ProgramFiles%\Universal Desktop Ruler\is-1H8N0.tmp to %ProgramFiles%\Universal Desktop Ruler\disclaim.txt
- from %ProgramFiles%\Universal Desktop Ruler\is-E1M7L.tmp to %ProgramFiles%\Universal Desktop Ruler\russian.lng
- from %ProgramFiles%\Universal Desktop Ruler\is-RSKV5.tmp to %ProgramFiles%\Universal Desktop Ruler\README.TXT
- from %ProgramFiles%\Universal Desktop Ruler\is-7B7F0.tmp to %ProgramFiles%\Universal Desktop Ruler\License.txt
- from %ProgramFiles%\Universal Desktop Ruler\is-1LM51.tmp to %ProgramFiles%\Universal Desktop Ruler\english.lng
- from %ProgramFiles%\Universal Desktop Ruler\is-ILOM8.tmp to %ProgramFiles%\Universal Desktop Ruler\UDRuler.exe
- from %ProgramFiles%\Universal Desktop Ruler\is-41J4I.tmp to %ProgramFiles%\Universal Desktop Ruler\unins000.exe
- from %ProgramFiles%\Universal Desktop Ruler\is-7BHDI.tmp to %ProgramFiles%\Universal Desktop Ruler\russian.chm
- from %ProgramFiles%\Universal Desktop Ruler\is-71CKU.tmp to %ProgramFiles%\Universal Desktop Ruler\english.chm
Substitutes the following files:
- %ProgramFiles%\Universal Desktop Ruler\README.TXT
Network activity:
Connects to:
- 'ip###ger.com':443
UDP:
- DNS ASK ip###ger.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following:
- '%TEMP%\is-14REJ.tmp\udruler.tmp' /SL5="$100E6,8818359,56832,%TEMP%\udruler.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\update.exe'
- '%TEMP%\udruler.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Executes the following:
- '<SYSTEM32>\cmd.exe' /c taskkill /im update.exe /f & erase %TEMP%\update.exe & exit
- '<SYSTEM32>\cmd.exe' /c %TEMP%\update.exe
- '<SYSTEM32>\cmd.exe' /c %TEMP%\udruler.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
