Trojan.DownLoader26.59762

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\UVKCommandsScript\Shell\Open\command] '' = '"%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe" -readfile "%1" %*'
[<HKLM>\SOFTWARE\Classes\SrSettingsFile\Shell\Open\command] '' = '"%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe" -ImportSr "%1" %*'
[<HKLM>\SOFTWARE\Classes\BackupInfoFile\Shell\Open\command] '' = '"%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe" -LoadBackup "%1" %*'
[<HKLM>\SOFTWARE\Classes\UVKLicenseKey\Shell\Open\command] '' = '"%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe" "%1"'

Modifies file system:

Creates the following files:

%ProgramFiles%\UVK - Ultra Virus Killer\2Browse.exe
%ProgramFiles%\UVK - Ultra Virus Killer\key.uvkey
%ProgramFiles%\UVK - Ultra Virus Killer\logo.png
%ProgramFiles%\UVK - Ultra Virus Killer\BrandIco.ico
%ProgramFiles%\UVK - Ultra Virus Killer\Third Party\uninstall_uvk.uvk
%ProgramFiles%\UVK - Ultra Virus Killer\Third Party\BrandIco.ico
%ProgramFiles%\UVK - Ultra Virus Killer\Third Party\hitmanpro_scan.uvk
%ProgramFiles%\UVK - Ultra Virus Killer\Third Party\CDASWin7-Vista.uvk
%ProgramFiles%\UVK - Ultra Virus Killer\Third Party\UVKSettings.ini
%ProgramFiles%\UVK - Ultra Virus Killer\urls
%ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb2.dat
%ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb.txt
%ALLUSERSPROFILE%\Desktop\SDS Computer Services Repair Tool.lnk
%ProgramFiles%\UVK - Ultra Virus Killer\UVK.lnk
%ProgramFiles%\UVK - Ultra Virus Killer\Logs\Log_2018-07-25.ini
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\checkversion[1].php
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\urls[1]
%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en64.exe
%ProgramFiles%\UVK - Ultra Virus Killer\Third Party\WhiteList.ini
%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe
%ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\history.txt
%ProgramFiles%\UVK - Ultra Virus Killer\AutoItRun.exe
%ProgramFiles%\UVK - Ultra Virus Killer\AutoItRun64.exe
%ProgramFiles%\UVK - Ultra Virus Killer\bluescreenview\BlueScreenView.chm
%ProgramFiles%\UVK - Ultra Virus Killer\bluescreenview\BlueScreenView.exe
%ProgramFiles%\UVK - Ultra Virus Killer\bluescreenview\readme.txt
%ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\cleanup.exe
%ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\cleanup.ini
%ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\msicuu.exe
%ProgramFiles%\UVK - Ultra Virus Killer\RebootExecx64.exe
%ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\msicuu_readme.txt
%ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\MsiZap.exe
%ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\readme.txt
%ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\sigcheck.exe
%ProgramFiles%\UVK - Ultra Virus Killer\Log analyzer.exe
%ProgramFiles%\UVK - Ultra Virus Killer\PortableZip.ini
%ProgramFiles%\UVK - Ultra Virus Killer\RebootExec.exe
%ProgramFiles%\UVK - Ultra Virus Killer\uvkres.dll
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\cloudsync[1].php

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb2.dat
%ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb.txt

Deletes the following files:

%ProgramFiles%\UVK - Ultra Virus Killer\BrandIco.ico

Substitutes the following files:

%ProgramFiles%\UVK - Ultra Virus Killer\BrandIco.ico

Network activity:

Connects to:

'ca###red.com':80

TCP:

HTTP GET requests:

http://www.ca###red.com/uvk/checkversion.php?e=################################################################ via ca###red.com
http://www.ca###red.com/uvk/urls via ca###red.com
http://www.ca###red.com/uvk/cloudsync.php?u=################################################################################################### via ca###red.com

UDP: