Technical Information
Malicious functions:
Executes the following:
- '%TEMP%\YOURU\urmain.exe'
Injects code into
the following user processes:
- urmain.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegMonClass', WindowName: ''
- ClassName: 'FileMonClass', WindowName: ''
Modifies file system:
Creates the following files:
- %TEMP%\YOURU\templates\proginfo_da.tpl
- %TEMP%\YOURU\templates\proginfo_cn.tpl
- %TEMP%\YOURU\templates\proginfo_bg.tpl
- %TEMP%\YOURU\templates\proginfo_hu.tpl
- %TEMP%\YOURU\templates\proginfo_fr.tpl
- %TEMP%\YOURU\templates\proginfo_en.tpl
- %TEMP%\YOURU\templates\proginfo_ar.tpl
- %TEMP%\YOURU\Languages\Turkish.lng
- %TEMP%\YOURU\Languages\T-Chinese.lng
- %TEMP%\YOURU\Languages\Spanish.lng
- %TEMP%\YOURU\urmain.RUS
- %TEMP%\YOURU\Languages\Vietnamese.lng
- %TEMP%\YOURU\Languages\Ukrainian.lng
- %TEMP%\YOURU\templates\proginfo_it.tpl
- %TEMP%\YOURU\inimerge.exe
- %TEMP%\YOURU\templates\proginfo_vn.tpl
- %TEMP%\YOURU\templates\proginfo_uk.tpl
- %APPDATA%\URSoft\Your Uninstaller\uruninstaller.ini
- %TEMP%\YOURU\armaccess.dll
- %TEMP%\YOURU\urmain.exe
- %TEMP%\YOURU\templates\proginfo_tw.tpl
- %TEMP%\YOURU\templates\proginfo_pt.tpl
- %TEMP%\YOURU\templates\proginfo_pl.tpl
- %TEMP%\YOURU\templates\proginfo_ko.tpl
- %TEMP%\YOURU\templates\proginfo_tr.tpl
- %TEMP%\YOURU\templates\proginfo_sp.tpl
- %TEMP%\YOURU\templates\proginfo_ru.tpl
- %TEMP%\YOURU\Languages\Slovak.lng
- %TEMP%\YOURU\Languages\Belarusian.lng
- %TEMP%\YOURU\Languages\Arabic.lng
- %TEMP%\YOURU\skipfilenames.dat
- %TEMP%\YOURU\Languages\Danish.lng
- %TEMP%\YOURU\Languages\Czech.lng
- %TEMP%\YOURU\Languages\Bulgarian.lng
- %TEMP%\YOURU\vclx70.bpl
- %TEMP%\YOURU\uruninstaller.ini
- %TEMP%\YOURU\diskclean.ico
- %TEMP%\YOURU\uninstaller.chm
- %TEMP%\YOURU\vcl70.bpl
- %TEMP%\YOURU\rtl70.bpl
- %TEMP%\YOURU\crosshair.ani
- %TEMP%\YOURU\Languages\Dutch.lng
- %TEMP%\YOURU\Languages\Portugues.lng
- %TEMP%\YOURU\Languages\Polish.lng
- %TEMP%\YOURU\Languages\Persian.lng
- %TEMP%\YOURU\Languages\Simplified Chinese.lng
- %TEMP%\YOURU\Languages\Serbian.lng
- %TEMP%\YOURU\Languages\Russian.lng
- %TEMP%\YOURU\Languages\Norwegian.lng
- %TEMP%\YOURU\Languages\German.lng
- %TEMP%\YOURU\Languages\French.lng
- %TEMP%\YOURU\Languages\English.lng
- %TEMP%\YOURU\Languages\korean.lng
- %TEMP%\YOURU\Languages\Italian.lng
- %TEMP%\YOURU\Languages\Hungarian.lng
Network activity:
Connects to:
- 'www.ur###tware.com':80
TCP:
HTTP GET requests:
- http://www.ur###tware.com/news.ini
- http://www.ur###tware.com/scripts/a1.php?N=################################################################################################################
UDP:
- DNS ASK www.ur###tware.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ThunderRT6FormDC' WindowName: ''
- ClassName: 'ThunderRT6FormDC' WindowName: 'Shareware Cheater v 3.0'
