Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Coordinator Themes Bluetooth Biometric Time' = '<LS_APPDATA>\revdxsdwkv\wlqbaqh.exe'
Malicious functions:
Creates and executes the following:
- '<LS_APPDATA>\revdxsdwkv\sklfsrnn.exe' "<LS_APPDATA>\revdxsdwkv\wlqbaqh.exe"
- '<LS_APPDATA>\revdxsdwkv\wlqbaqh.exe'
Modifies file system :
Creates the following files:
- <LS_APPDATA>\revdxsdwkv\wlqbaqh.ujd
- <LS_APPDATA>\revdxsdwkv\sklfsrnn.exe
- <LS_APPDATA>\revdxsdwkv\wlqbaqh.exe
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\revdxsdwkv\sklfsrnn.exe
- <LS_APPDATA>\revdxsdwkv\wlqbaqh.exe
Network activity:
Connects to:
- 'ga###rheart.net':80
- 'be####perfect.net':80
- 'be###rheart.net':80
- 'st####battle.net':80
- 'tr###battle.net':80
- 'be####battle.net':80
- 'ga####battle.net':80
- 'ga###rmayor.net':80
- 'ga####perfect.net':80
- 'be###rmayor.net':80
- 'tr###mayor.net':80
- 're####battle.net':80
- 'el####icbattle.net':80
- 'el####icmayor.net':80
- 'el####icperfect.net':80
- 're###dmayor.net':80
- 'tr####erfect.net':80
- 'st###tmayor.net':80
- 'st####perfect.net':80
- 'st###theart.net':80
- 'tr###heart.net':80
- 'qu###battle.net':80
- 'se####battle.net':80
- 'se###nmayor.net':80
- 'se####perfect.net':80
- 'qu###mayor.net':80
- 'pr####treason.net':80
- 'th####rderly.net':80
- 'th###reason.net':80
- 'th###almost.net':80
- 'pr####talmost.net':80
- 'qu####erfect.net':80
- 'br####erfect.net':80
- 'fl###mayor.net':80
- 'fl####erfect.net':80
- 'fl###heart.net':80
- 'br###heart.net':80
- 'qu###heart.net':80
- 'se###nheart.net':80
- 'br###battle.net':80
- 'br###mayor.net':80
- 'fl###battle.net':80
- 're####perfect.net':80
- 'qu###white.net':80
- 'se###nwhite.net':80
- 'se####million.net':80
- 'se####pleasure.net':80
- 'qu####illion.net':80
- 'do####erfect.net':80
- 'ag####tmayor.net':80
- 'ag####tperfect.net':80
- 'ag####theart.net':80
- 'do###heart.net':80
- 'qu####leasure.net':80
- 'br####leasure.net':80
- 'fl####illion.net':80
- 'fl####leasure.net':80
- 'fl###toward.net':80
- 'br###toward.net':80
- 'qu###toward.net':80
- 'se####toward.net':80
- 'br###white.net':80
- 'br####illion.net':80
- 'fl###white.net':80
- 'ca####nperfect.net':80
- 'la###mayor.net':80
- 'la####erfect.net':80
- 'la###heart.net':80
- 'ca####nheart.net':80
- 're###dheart.net':80
- 'el####icheart.net':80
- 'ca####nbattle.net':80
- 'ca####nmayor.net':80
- 'la###battle.net':80
- 'de####battle.net':80
- 'ni###heart.net':80
- 'de###eheart.net':80
- 'do###battle.net':80
- 'do###mayor.net':80
- 'ag####tbattle.net':80
- 'de###emayor.net':80
- 'ni###battle.net':80
- 'ni###mayor.net':80
- 'ni####erfect.net':80
- 'de####perfect.net':80
TCP:
HTTP GET requests:
- ga###rheart.net/forum/search.php?em#################################
- be####perfect.net/forum/search.php?em#################################
- be###rheart.net/forum/search.php?em#################################
- st####battle.net/forum/search.php?em#################################
- tr###battle.net/forum/search.php?em#################################
- be####battle.net/forum/search.php?em#################################
- ga####battle.net/forum/search.php?em#################################
- ga###rmayor.net/forum/search.php?em#################################
- ga####perfect.net/forum/search.php?em#################################
- be###rmayor.net/forum/search.php?em#################################
- tr###mayor.net/forum/search.php?em#################################
- re####battle.net/forum/search.php?em#################################
- el####icbattle.net/forum/search.php?em#################################
- el####icmayor.net/forum/search.php?em#################################
- el####icperfect.net/forum/search.php?em#################################
- re###dmayor.net/forum/search.php?em#################################
- tr####erfect.net/forum/search.php?em#################################
- st###tmayor.net/forum/search.php?em#################################
- st####perfect.net/forum/search.php?em#################################
- st###theart.net/forum/search.php?em#################################
- tr###heart.net/forum/search.php?em#################################
- qu###battle.net/forum/search.php?em#################################
- se####battle.net/forum/search.php?em#################################
- se###nmayor.net/forum/search.php?em#################################
- se####perfect.net/forum/search.php?em#################################
- qu###mayor.net/forum/search.php?em#################################
- pr####treason.net/forum/search.php?em#################################
- th####rderly.net/forum/search.php?em#################################
- th###reason.net/forum/search.php?em#################################
- th###almost.net/forum/search.php?em#################################
- pr####talmost.net/forum/search.php?em#################################
- qu####erfect.net/forum/search.php?em#################################
- br####erfect.net/forum/search.php?em#################################
- fl###mayor.net/forum/search.php?em#################################
- fl####erfect.net/forum/search.php?em#################################
- fl###heart.net/forum/search.php?em#################################
- br###heart.net/forum/search.php?em#################################
- qu###heart.net/forum/search.php?em#################################
- se###nheart.net/forum/search.php?em#################################
- br###battle.net/forum/search.php?em#################################
- br###mayor.net/forum/search.php?em#################################
- fl###battle.net/forum/search.php?em#################################
- re####perfect.net/forum/search.php?em#################################
- qu###white.net/forum/search.php?em#################################
- se###nwhite.net/forum/search.php?em#################################
- se####million.net/forum/search.php?em#################################
- se####pleasure.net/forum/search.php?em#################################
- qu####illion.net/forum/search.php?em#################################
- do####erfect.net/forum/search.php?em#################################
- ag####tmayor.net/forum/search.php?em#################################
- ag####tperfect.net/forum/search.php?em#################################
- ag####theart.net/forum/search.php?em#################################
- do###heart.net/forum/search.php?em#################################
- qu####leasure.net/forum/search.php?em#################################
- br####leasure.net/forum/search.php?em#################################
- fl####illion.net/forum/search.php?em#################################
- fl####leasure.net/forum/search.php?em#################################
- fl###toward.net/forum/search.php?em#################################
- br###toward.net/forum/search.php?em#################################
- qu###toward.net/forum/search.php?em#################################
- se####toward.net/forum/search.php?em#################################
- br###white.net/forum/search.php?em#################################
- br####illion.net/forum/search.php?em#################################
- fl###white.net/forum/search.php?em#################################
- ca####nperfect.net/forum/search.php?em#################################
- la###mayor.net/forum/search.php?em#################################
- la####erfect.net/forum/search.php?em#################################
- la###heart.net/forum/search.php?em#################################
- ca####nheart.net/forum/search.php?em#################################
- re###dheart.net/forum/search.php?em#################################
- el####icheart.net/forum/search.php?em#################################
- ca####nbattle.net/forum/search.php?em#################################
- ca####nmayor.net/forum/search.php?em#################################
- la###battle.net/forum/search.php?em#################################
- de####battle.net/forum/search.php?em#################################
- ni###heart.net/forum/search.php?em#################################
- de###eheart.net/forum/search.php?em#################################
- do###battle.net/forum/search.php?em#################################
- do###mayor.net/forum/search.php?em#################################
- ag####tbattle.net/forum/search.php?em#################################
- de###emayor.net/forum/search.php?em#################################
- ni###battle.net/forum/search.php?em#################################
- ni###mayor.net/forum/search.php?em#################################
- ni####erfect.net/forum/search.php?em#################################
- de####perfect.net/forum/search.php?em#################################
UDP:
- DNS ASK ga###rheart.net
- DNS ASK be####perfect.net
- DNS ASK be###rheart.net
- DNS ASK st####battle.net
- DNS ASK tr###battle.net
- DNS ASK be####battle.net
- DNS ASK ga####battle.net
- DNS ASK ga###rmayor.net
- DNS ASK ga####perfect.net
- DNS ASK be###rmayor.net
- DNS ASK tr###mayor.net
- DNS ASK re####battle.net
- DNS ASK el####icbattle.net
- DNS ASK el####icmayor.net
- DNS ASK el####icperfect.net
- DNS ASK re###dmayor.net
- DNS ASK tr####erfect.net
- DNS ASK st###tmayor.net
- DNS ASK st####perfect.net
- DNS ASK st###theart.net
- DNS ASK tr###heart.net
- DNS ASK qu###battle.net
- DNS ASK se####battle.net
- DNS ASK se###nmayor.net
- DNS ASK se####perfect.net
- DNS ASK qu###mayor.net
- DNS ASK pr####treason.net
- DNS ASK th####rderly.net
- DNS ASK th###reason.net
- DNS ASK th###almost.net
- DNS ASK pr####talmost.net
- DNS ASK qu####erfect.net
- DNS ASK br####erfect.net
- DNS ASK fl###mayor.net
- DNS ASK fl####erfect.net
- DNS ASK fl###heart.net
- DNS ASK br###heart.net
- DNS ASK qu###heart.net
- DNS ASK se###nheart.net
- DNS ASK br###battle.net
- DNS ASK br###mayor.net
- DNS ASK fl###battle.net
- DNS ASK re####perfect.net
- DNS ASK qu###white.net
- DNS ASK se###nwhite.net
- DNS ASK se####million.net
- DNS ASK se####pleasure.net
- DNS ASK qu####illion.net
- DNS ASK do####erfect.net
- DNS ASK ag####tmayor.net
- DNS ASK ag####tperfect.net
- DNS ASK ag####theart.net
- DNS ASK do###heart.net
- DNS ASK qu####leasure.net
- DNS ASK br####leasure.net
- DNS ASK fl####illion.net
- DNS ASK fl####leasure.net
- DNS ASK fl###toward.net
- DNS ASK br###toward.net
- DNS ASK qu###toward.net
- DNS ASK se####toward.net
- DNS ASK br###white.net
- DNS ASK br####illion.net
- DNS ASK fl###white.net
- DNS ASK ca####nperfect.net
- DNS ASK la###mayor.net
- DNS ASK la####erfect.net
- DNS ASK la###heart.net
- DNS ASK ca####nheart.net
- DNS ASK re###dheart.net
- DNS ASK el####icheart.net
- DNS ASK ca####nbattle.net
- DNS ASK ca####nmayor.net
- DNS ASK la###battle.net
- DNS ASK de####battle.net
- DNS ASK ni###heart.net
- DNS ASK de###eheart.net
- DNS ASK do###battle.net
- DNS ASK do###mayor.net
- DNS ASK ag####tbattle.net
- DNS ASK de###emayor.net
- DNS ASK ni###battle.net
- DNS ASK ni###mayor.net
- DNS ASK ni####erfect.net
- DNS ASK de####perfect.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''