Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\install\unreal\setenv.exe' -m uncom_dir "C:\unreal"
- 'C:\install\unreal\nircmd.exe' paramsfile "C:\install\unreal\remfiles.lst" "" "" execmd attrib -a -r -s -h ~$fparam.1$
- 'C:\install\unreal\nircmd.exe' paramsfile "C:\install\unreal\remdirs.lst" "" "" execmd attrib -a -r -s -h ~$fparam.1$ /s /d
- 'C:\install\unreal\setenv.exe' -m allstartmenu "%ALLUSERSPROFILE%\Start Menu"
- 'C:\install\unreal\setenv.exe' -u qlaunch "%APPDATA%\microsoft\internet explorer\quick launch"
- 'C:\install\unreal\setenv.exe' -m allprograms "%ALLUSERSPROFILE%\Start Menu\Programs"
- 'C:\install\unreal\setenv.exe' -m alldesktop "%ALLUSERSPROFILE%\Desktop"
- 'C:\install\unreal\nircmd.exe' paramsfile "C:\install\unreal\remfiles.lst" "" "" execmd del /f /q ~$fparam.1$
- 'C:\install\unreal\nircmd.exe' shortcut "C:\unreal\uncom.exe" "~$folder.common_desktop$\" "unreal" "" "C:\unreal\unreal.ico"
- 'C:\install\unreal\nircmd.exe' shortcut "C:\unreal\uncom.exe" "%APPDATA%\microsoft\internet explorer\quick launch" "unreal" "" "C:\unreal\unreal.ico"
- 'C:\install\unreal\nircmd.exe' cmdwait 1000 execmd del /f /q C:\install\unreal\*.exe
- 'C:\install\unreal\nircmd.exe' shortcut "C:\unreal\uncom.exe" "~$folder.common_programs$\" "unreal" "" "C:\unreal\unreal.ico"
- 'C:\install\unreal\nircmd.exe' paramsfile "C:\install\unreal\remdirs.lst" "" "" execmd rmdir /s /q ~$fparam.1$
- 'C:\install\unreal\7za.exe' x -r -y -oC: C:\install\unreal\unrealcfg.7z
- 'C:\install\unreal\swreg.exe' add "hkey_local_machine\software\microsoft\windows\currentversion\app paths\uncom.exe" /v "" /t reg_sz /d "C:\unreal\uncom.exe" /f
- 'C:\install\unreal\nircmd.exe' inisetval "C:\install\unreal\shelldirs.ini" "shelldirs" "desktop" "~$folder.desktop$"
- 'C:\install\unreal\nircmd.exe' inisetval "C:\install\unreal\shelldirs.ini" "shelldirs" "alldesktop" "~$folder.common_desktop$"
- 'C:\install\unreal\nircmd.exe' inisetval "C:\install\unreal\shelldirs.ini" "shelldirs" "startmenu" "~$folder.start_menu$"
- 'C:\unreal\Uncom.exe'
- 'C:\install\unreal\nircmd.exe' killprocess uncom.exe
- 'C:\install\unreal\uncomset.exe' /sp- /verysilent /nocancel /norestart /lang=en /dir=C:\unreal /noicons
- '%TEMP%\is-7DPPB.tmp\is-8OMLF.tmp' /SL4 $200EC "C:\install\unreal\uncomset.exe" 1967900 73216 /sp- /verysilent /nocancel /norestart /lang=en /dir=C:\unreal /noicons
- 'C:\install\unreal\nircmd.exe' inisetval "C:\install\unreal\shelldirs.ini" "shelldirs" "allstartmenu" "~$folder.common_start_menu$"
- 'C:\install\unreal\setenv.exe' -u desktop "%HOMEPATH%\Desktop"
- 'C:\install\unreal\setenv.exe' -u startmenu "%HOMEPATH%\Start Menu"
- 'C:\install\unreal\setenv.exe' -u programs "%HOMEPATH%\Start Menu\Programs"
- 'C:\install\unreal\inifile.exe' shelldirs.ini [shelldirs]
- 'C:\install\unreal\nircmd.exe' inisetval "C:\install\unreal\shelldirs.ini" "shelldirs" "programs" "~$folder.programs$"
- 'C:\install\unreal\nircmd.exe' inisetval "C:\install\unreal\shelldirs.ini" "shelldirs" "allprograms" "~$folder.common_programs$"
- 'C:\install\unreal\nircmd.exe' inisetval "C:\install\unreal\shelldirs.ini" "shelldirs" "qlaunch" "~$folder.appdata$\microsoft\internet explorer\quick launch"
Executes the following:
- '<SYSTEM32>\attrib.exe' -a -r -s -h "%HOMEPATH%\Start Menu\Programs\unreal commander" /s /d
- '<SYSTEM32>\attrib.exe' -a -r -s -h "%ALLUSERSPROFILE%\Start Menu\Programs\unreal commander" /s /d
- '<SYSTEM32>\attrib.exe' -a -r -s -h "C:\unreal\universal viewer" /s /d
- '<SYSTEM32>\attrib.exe' -a -r -s -h C:\unreal\help /s /d
- '<SYSTEM32>\attrib.exe' -a -r -s -h C:\unreal\plugins /s /d
- '%WINDIR%\regedit.exe' /s "C:\unreal\addons\fonts\sony.reg"
- '%WINDIR%\regedit.exe' /s "C:\unreal\addons\fonts\droid.reg"
- '%WINDIR%\regedit.exe' /s "C:\unreal\addons\fonts\gost_b.reg"
- '%WINDIR%\regedit.exe' /s "C:\unreal\addons\textview.reg"
- '%WINDIR%\regedit.exe' /s "C:\unreal\addons\fonts\gost_a.reg"
- '<SYSTEM32>\attrib.exe' -a -r -s -h C:\unreal\graphics /s /d
- '<SYSTEM32>\attrib.exe' -a -r -s -h C:\unreal\uncomstyles.ini
- '<SYSTEM32>\attrib.exe' -a -r -s -h C:\unreal\uncomsetup.exe
- '<SYSTEM32>\chcp.com' 1251
- '<SYSTEM32>\cmd.exe' /c ""C:\install\unreal\uncomset.cmd" "
- '<SYSTEM32>\mode.com' con cols=60 lines=20
- '<SYSTEM32>\attrib.exe' -a -r -s -h "%HOMEPATH%\Desktop\unreal commander.lnk"
- '<SYSTEM32>\attrib.exe' -a -r -s -h "%ALLUSERSPROFILE%\Desktop\unreal commander.lnk"
- '<SYSTEM32>\attrib.exe' -a -r -s -h C:\unreal\uninst.ico
- '<SYSTEM32>\attrib.exe' -a -r -s -h C:\unreal\unins000.dat
- '<SYSTEM32>\attrib.exe' -a -r -s -h C:\unreal\unins000.exe
Modifies file system :
Creates the following files:
- C:\unreal\addons\rc0\uncomstyles.ini
- C:\unreal\addons\rc0\uncom.ini
- C:\unreal\addons\fonts\droid.ttf
- C:\unreal\uncomstyles.ini
- C:\unreal\plugins\packer\multiarc\multiarc.ini
- C:\unreal\desktop.ini
- C:\unreal\addons\rc0\notepad2.ini
- C:\unreal\addons\notepad2.ini
- C:\unreal\plugins\packer\7zip\lang\russian.lng
- C:\unreal\plugins\packer\7zip\lang\english.lng
- C:\unreal\graphics\tango(tanooki).pgl
- C:\unreal\plugins\packer\multiarc\lang\russian.lng
- C:\unreal\addons\fonts\gost_a.ttf
- C:\unreal\addons\fonts\droid_m.ttf
- C:\unreal\addons\fonts\sony.ttf
- C:\unreal\addons\fonts\gost_b.ttf
- C:\unreal\addons\textview.reg
- C:\install\unreal\shelldirs.ini
- C:\unreal\Uncom.bar
- C:\unreal\unreal.ico
- C:\install\unreal\shelldirs.cmd
- %ALLUSERSPROFILE%\Start Menu\Programs\Unreal Commander\Uninstall Unreal Commander.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Unreal Commander\Unreal Commander.lnk
- C:\unreal\unins000.dat
- %ALLUSERSPROFILE%\Desktop\Unreal Commander.lnk
- C:\unreal\addons\fonts\gost_a.reg
- C:\unreal\addons\fonts\droid_m.reg
- C:\unreal\addons\fonts\sony.reg
- C:\unreal\addons\fonts\gost_b.reg
- C:\unreal\unreal.cmd
- C:\unreal\license.key
- C:\unreal\addons\fonts\droid.reg
- C:\unreal\ignorelist.txt
- C:\unreal\plugins\packer\multiarc\conspawn.pipe
- C:\unreal\addons\textview.exe
- C:\unreal\addons\notepad2.exe
- C:\unreal\plugins\packer\ishield\zd50149.dll
- C:\unreal\plugins\packer\instexpl\instexpl.dll
- C:\unreal\plugins\packer\iso\iso.wcx
- C:\unreal\plugins\packer\ishield\ishield.wcx
- C:\unreal\addons\nircmd.exe
- C:\unreal\plugins\packer\multiarc\multiarc.wcx
- %ALLUSERSPROFILE%\Start Menu\Programs\unreal.lnk
- %WINDIR%\Fonts\droid_m.ttf
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\unreal.lnk
- %ALLUSERSPROFILE%\Desktop\unreal.lnk
- %WINDIR%\Fonts\gost_a.ttf
- C:\unreal\plugins\packer\ishield\zd51145.dll
- %WINDIR%\Fonts\sony.ttf
- %WINDIR%\Fonts\gost_b.ttf
- C:\unreal\plugins\packer\instexpl\instexpl.wcx
- C:\unreal\plugins\packer\instexpl\unp\eschalon.unp
- C:\unreal\plugins\packer\instexpl\unp\bzip2_3.unp
- C:\unreal\plugins\packer\instexpl\unp\inflate1.unp
- C:\unreal\plugins\packer\instexpl\unp\gentee.unp
- C:\unreal\graphics\tango(tanooki).tgl
- C:\unreal\uncom.remap
- C:\unreal\plugins\packer\instexpl\unp\bzip2_2.unp
- C:\unreal\plugins\packer\instexpl\unp\bzip2_1.unp
- C:\unreal\plugins\packer\7zip\7zip.wcx
- C:\unreal\plugins\packer\instexpl\unp\vise.unp
- C:\unreal\plugins\packer\iclread\iclread.wcx
- C:\unreal\plugins\packer\dbx\dbxplug.wcx
- C:\unreal\plugins\packer\instexpl\unp\inflate3.unp
- C:\unreal\plugins\packer\instexpl\unp\inflate2.unp
- C:\unreal\plugins\packer\instexpl\unp\pkware.unp
- C:\unreal\plugins\packer\instexpl\unp\lzma.unp
- %WINDIR%\is-B7GGI.tmp
- C:\unreal\Graphics\is-8AOE2.tmp
- C:\unreal\Graphics\is-RARHC.tmp
- C:\unreal\is-7II4B.tmp
- C:\unreal\is-2RG2N.tmp
- C:\unreal\is-LC50H.tmp
- C:\unreal\is-AMO8S.tmp
- C:\unreal\Graphics\is-BFHSG.tmp
- C:\unreal\is-ESVG5.tmp
- C:\unreal\Universal Viewer\Viewer.ini
- C:\unreal\Uncom.ini
- C:\unreal\Languages\is-9QR88.tmp
- C:\unreal\is-0IFOK.tmp
- C:\unreal\Help\is-43PON.tmp
- C:\unreal\is-9OVFN.tmp
- C:\unreal\is-9QR4O.tmp
- C:\unreal\Help\is-07QN0.tmp
- C:\unreal\is-CIMFC.tmp
- C:\install\unreal\7za.exe
- C:\install\unreal\remfiles.lst
- C:\install\unreal\nircmd.exe
- C:\install\unreal\inifile.exe
- C:\install\unreal\uncomset.cmd
- C:\install\unreal\unrealcfg.7z
- C:\install\unreal\remdirs.lst
- C:\install\unreal\7cfg.txt
- %TEMP%\is-7DPPB.tmp\is-8OMLF.tmp
- C:\install\unreal\uncomset.log
- %TEMP%\is-JEJCH.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-JEJCH.tmp\_isetup\_RegDLL.tmp
- C:\install\unreal\swreg.exe
- C:\install\unreal\setenv.exe
- C:\install\unreal\7zsd.sfx
- C:\install\unreal\uncomset.exe
- C:\unreal\Languages\is-2JIJO.tmp
- C:\unreal\Universal Viewer\is-4OAM8.tmp
- C:\unreal\Universal Viewer\is-5CRE7.tmp
- C:\unreal\Universal Viewer\is-9140R.tmp
- C:\unreal\Universal Viewer\is-E993K.tmp
- C:\unreal\Universal Viewer\is-B466J.tmp
- C:\unreal\Universal Viewer\is-095I3.tmp
- C:\unreal\Universal Viewer\is-E6H3R.tmp
- C:\unreal\Universal Viewer\is-3OV6E.tmp
- C:\unreal\Universal Viewer\is-1DCUM.tmp
- C:\unreal\Universal Viewer\is-TODUM.tmp
- C:\unreal\is-38P04.tmp
- C:\unreal\Universal Viewer\is-7GGRS.tmp
- C:\unreal\Universal Viewer\is-6Q6H1.tmp
- C:\unreal\Universal Viewer\is-7A0M5.tmp
- C:\unreal\Universal Viewer\is-AFBKB.tmp
- C:\unreal\Universal Viewer\is-NLS8H.tmp
- C:\unreal\Universal Viewer\is-SV5VK.tmp
- C:\unreal\Universal Viewer\is-OQ115.tmp
- C:\unreal\Languages\is-HM9Q1.tmp
- C:\unreal\Universal Viewer\is-8QF5I.tmp
- C:\unreal\Universal Viewer\is-TLP91.tmp
- C:\unreal\Languages\is-42SKR.tmp
- C:\unreal\Languages\is-1V4VC.tmp
- C:\unreal\is-15UJL.tmp
- C:\unreal\is-KA68E.tmp
- C:\unreal\Universal Viewer\is-UHL11.tmp
- C:\unreal\Universal Viewer\is-VIBQD.tmp
- C:\unreal\Universal Viewer\is-10JU6.tmp
- C:\unreal\Universal Viewer\is-42EUB.tmp
- C:\unreal\Universal Viewer\is-8B8EA.tmp
- C:\unreal\Universal Viewer\is-4GJUF.tmp
- C:\unreal\Universal Viewer\is-KCKC5.tmp
- C:\unreal\Universal Viewer\is-U75TO.tmp
Sets the 'hidden' attribute to the following files:
- C:\unreal\desktop.ini
Deletes the following files:
- C:\unreal\Universal Viewer\Valencian.lng
- C:\unreal\Universal Viewer\Ukrainian.lng
- C:\unreal\Universal Viewer\Swedish.lng
- C:\unreal\Universal Viewer\Vietnamese.lng
- %ALLUSERSPROFILE%\Start Menu\Programs\Unreal Commander\Unreal Commander.lnk
- C:\unreal\Universal Viewer\Viewer.ini
- %ALLUSERSPROFILE%\Start Menu\Programs\Unreal Commander\Uninstall Unreal Commander.lnk
- C:\unreal\Universal Viewer\Russian.lng
- C:\unreal\Universal Viewer\Polish.lng
- C:\unreal\Universal Viewer\Korean.lng
- C:\unreal\Universal Viewer\Slovak.lng
- C:\unreal\Universal Viewer\Standard 24x24.bmp
- C:\unreal\Universal Viewer\Spanish.lng
- C:\unreal\Universal Viewer\Spanish (2).lng
- C:\unreal\Uncom.ini
- C:\install\unreal\inifile.exe
- C:\install\unreal\7za.exe
- C:\unreal\license.key
- C:\install\unreal\nircmd.exe
- C:\install\unreal\uncomset.exe
- C:\install\unreal\swreg.exe
- C:\install\unreal\setenv.exe
- C:\install\unreal\remfiles.lst
- C:\install\unreal\remdirs.lst
- C:\unreal\Uncom.remap
- C:\install\unreal\7cfg.txt
- C:\install\unreal\shelldirs.ini
- C:\install\unreal\shelldirs.cmd
- C:\install\unreal\unrealcfg.7z
- C:\unreal\Universal Viewer\Japanese.lng
- C:\unreal\Graphics\duxlabBlacky.tgl
- %ALLUSERSPROFILE%\Desktop\Unreal Commander.lnk
- C:\unreal\uninst.ico
- C:\unreal\Graphics\Only simple.pgl
- C:\unreal\Help\Uncom_ru.chm
- C:\unreal\Help\Uncom_en.chm
- C:\unreal\Graphics\Triangles theme.tgl
- %TEMP%\is-7DPPB.tmp\is-8OMLF.tmp
- %TEMP%\is-JEJCH.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-JEJCH.tmp\_isetup\_RegDLL.tmp
- C:\unreal\Uncomstyles.ini
- C:\unreal\unins000.exe
- C:\unreal\unins000.dat
- C:\unreal\uncomsetup.exe
- C:\unreal\Universal Viewer\Bulgarian.lng
- C:\unreal\Universal Viewer\German.lng
- C:\unreal\Universal Viewer\French.lng
- C:\unreal\Universal Viewer\English.lng
- C:\unreal\Universal Viewer\Hebrew.lng
- C:\unreal\Universal Viewer\Italian.lng
- C:\unreal\Universal Viewer\Hungarian.lng
- C:\unreal\Universal Viewer\Hellenic.lng
- C:\unreal\Universal Viewer\Chinese Traditional.lng
- C:\unreal\Universal Viewer\Chinese Simplified.lng
- C:\unreal\Universal Viewer\Byelarussian.lng
- C:\unreal\Universal Viewer\Clo 24x24.bmp
- C:\unreal\Universal Viewer\Dutch.lng
- C:\unreal\Universal Viewer\Danish.lng
- C:\unreal\Universal Viewer\Czech.lng
Moves the following files:
- from C:\unreal\Universal Viewer\is-095I3.tmp to C:\unreal\Universal Viewer\Hungarian.lng
- from C:\unreal\Universal Viewer\is-SV5VK.tmp to C:\unreal\Universal Viewer\Hellenic.lng
- from C:\unreal\Universal Viewer\is-10JU6.tmp to C:\unreal\Universal Viewer\Hebrew.lng
- from C:\unreal\Universal Viewer\is-E6H3R.tmp to C:\unreal\Universal Viewer\Korean.lng
- from C:\unreal\Universal Viewer\is-3OV6E.tmp to C:\unreal\Universal Viewer\Japanese.lng
- from C:\unreal\Universal Viewer\is-B466J.tmp to C:\unreal\Universal Viewer\Italian.lng
- from C:\unreal\Universal Viewer\is-KCKC5.tmp to C:\unreal\Universal Viewer\Dutch.lng
- from C:\unreal\Universal Viewer\is-U75TO.tmp to C:\unreal\Universal Viewer\Danish.lng
- from C:\unreal\Universal Viewer\is-8B8EA.tmp to C:\unreal\Universal Viewer\Czech.lng
- from C:\unreal\Universal Viewer\is-42EUB.tmp to C:\unreal\Universal Viewer\German.lng
- from C:\unreal\Universal Viewer\is-UHL11.tmp to C:\unreal\Universal Viewer\French.lng
- from C:\unreal\Universal Viewer\is-VIBQD.tmp to C:\unreal\Universal Viewer\English.lng
- from C:\unreal\Universal Viewer\is-5CRE7.tmp to C:\unreal\Universal Viewer\Polish.lng
- from C:\unreal\Universal Viewer\is-1DCUM.tmp to C:\unreal\Universal Viewer\Clo 24x24.bmp
- from C:\unreal\Universal Viewer\is-TODUM.tmp to C:\unreal\Universal Viewer\Vietnamese.lng
- from C:\unreal\Universal Viewer\is-AFBKB.tmp to C:\unreal\Universal Viewer\Valencian.lng
- from %WINDIR%\is-B7GGI.tmp to %WINDIR%\noclose.pif
- from C:\unreal\is-38P04.tmp to C:\unreal\uncomsetup.exe
- from C:\unreal\Universal Viewer\is-7GGRS.tmp to C:\unreal\Universal Viewer\Standard 24x24.bmp
- from C:\unreal\Universal Viewer\is-9140R.tmp to C:\unreal\Universal Viewer\Spanish (2).lng
- from C:\unreal\Universal Viewer\is-E993K.tmp to C:\unreal\Universal Viewer\Slovak.lng
- from C:\unreal\Universal Viewer\is-4OAM8.tmp to C:\unreal\Universal Viewer\Russian.lng
- from C:\unreal\Universal Viewer\is-NLS8H.tmp to C:\unreal\Universal Viewer\Ukrainian.lng
- from C:\unreal\Universal Viewer\is-6Q6H1.tmp to C:\unreal\Universal Viewer\Swedish.lng
- from C:\unreal\Universal Viewer\is-7A0M5.tmp to C:\unreal\Universal Viewer\Spanish.lng
- from C:\unreal\is-7II4B.tmp to C:\unreal\license_ru.txt
- from C:\unreal\is-2RG2N.tmp to C:\unreal\license_en.txt
- from C:\unreal\Graphics\is-8AOE2.tmp to C:\unreal\Graphics\duxlabBlacky.tgl
- from C:\unreal\Help\is-07QN0.tmp to C:\unreal\Help\Uncom_en.chm
- from C:\unreal\Help\is-43PON.tmp to C:\unreal\Help\Uncom_ru.chm
- from C:\unreal\is-9OVFN.tmp to C:\unreal\uninst.ico
- from C:\unreal\is-LC50H.tmp to C:\unreal\Unrar.dll
- from C:\unreal\is-AMO8S.tmp to C:\unreal\Uncom.exe
- from C:\unreal\is-CIMFC.tmp to C:\unreal\unins000.exe
- from C:\unreal\Graphics\is-RARHC.tmp to C:\unreal\Graphics\Triangles theme.tgl
- from C:\unreal\Graphics\is-BFHSG.tmp to C:\unreal\Graphics\Only simple.pgl
- from C:\unreal\is-ESVG5.tmp to C:\unreal\Unacev2.dll
- from C:\unreal\is-9QR4O.tmp to C:\unreal\Uncom.ini
- from C:\unreal\Universal Viewer\is-OQ115.tmp to C:\unreal\Universal Viewer\Bulgarian.lng
- from C:\unreal\Languages\is-HM9Q1.tmp to C:\unreal\Languages\Russian.inc
- from C:\unreal\is-15UJL.tmp to C:\unreal\Uncom.inc
- from C:\unreal\Universal Viewer\is-4GJUF.tmp to C:\unreal\Universal Viewer\Chinese Traditional.lng
- from C:\unreal\Universal Viewer\is-8QF5I.tmp to C:\unreal\Universal Viewer\Chinese Simplified.lng
- from C:\unreal\Universal Viewer\is-TLP91.tmp to C:\unreal\Universal Viewer\Byelarussian.lng
- from C:\unreal\Languages\is-2JIJO.tmp to C:\unreal\Languages\English.menu
- from C:\unreal\Languages\is-9QR88.tmp to C:\unreal\Languages\English.lang
- from C:\unreal\is-0IFOK.tmp to C:\unreal\Uncomstyles.ini
- from C:\unreal\is-KA68E.tmp to C:\unreal\Uncom.remap
- from C:\unreal\Languages\is-42SKR.tmp to C:\unreal\Languages\Russian.menu
- from C:\unreal\Languages\is-1V4VC.tmp to C:\unreal\Languages\Russian.lang
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
