Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RevoltG_Serivce' = '%TEMP%\RevoltG\\RevoltG_Service.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Registry Editor (RegEdit)
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\RevoltG\New UI\Client_Icon\uplay.bmp
- %TEMP%\aut1E.tmp
- %TEMP%\RevoltG\New UI\Client_Icon\steam.bmp
- %TEMP%\aut1D.tmp
- %TEMP%\RevoltG\New UI\Client_Icon\origin.bmp
- %TEMP%\aut1C.tmp
- %TEMP%\RevoltG\New UI\Client_Icon\lol.bmp
- %TEMP%\aut1B.tmp
- %TEMP%\RevoltG\New UI\Client_Icon\battle.bmp
- %TEMP%\aut1A.tmp
- %TEMP%\RevoltG\New UI\RDown\setting2.bmp
- %TEMP%\aut19.tmp
- %TEMP%\RevoltG\New UI\RDown\setting1.bmp
- %TEMP%\aut18.tmp
- %TEMP%\RevoltG\New UI\RDown\btn_h.bmp
- %TEMP%\aut17.tmp
- %TEMP%\RevoltG\New UI\Client_Icon\revoltg.bmp
- %TEMP%\aut20.tmp
- %TEMP%\RevoltG\revolt_icon.ico
- %TEMP%\aut21.tmp
- %TEMP%\USkinDLL.dll
- %TEMP%\RevoltG\RevoltG_Service.exe
- %TEMP%\aut29.tmp
- %TEMP%\RevoltG\7zip.exe
- %TEMP%\aut28.tmp
- %TEMP%\RevoltG\audio\message.mp3
- %TEMP%\aut27.tmp
- %TEMP%\RevoltG\audio\30min.mp3
- %TEMP%\RevoltG\audio\15min.mp3
- %TEMP%\aut26.tmp
- %TEMP%\aut25.tmp
- %TEMP%\RevoltG\audio\10min.mp3
- %TEMP%\aut24.tmp
- %TEMP%\RevoltG\audio\5min.mp3
- %TEMP%\aut23.tmp
- %TEMP%\RevoltG\Skin.msstyles.dll
- %TEMP%\aut22.tmp
- %TEMP%\RevoltG\noscrubs_bold.ttf
- %APPDATA%\RevoltG\RevoltG.exe
- %TEMP%\RevoltG\New UI\RDown\btn_nh.bmp
- %TEMP%\aut16.tmp
- %TEMP%\RevoltG\New UI\Window\vip.bmp
- %TEMP%\RevoltG\New UI\Window\clock.bmp
- %TEMP%\aut9.tmp
- %TEMP%\RevoltG\New UI\userWidget_ico.bmp
- %TEMP%\aut8.tmp
- %TEMP%\RevoltG\New UI\icontool.bmp
- %TEMP%\aut7.tmp
- %TEMP%\RevoltG\New UI\BootstrapBackground.bmp
- %TEMP%\aut6.tmp
- %TEMP%\RevoltG\New UI\background2.bmp
- %TEMP%\aut5.tmp
- %TEMP%\RevoltG\New UI\background.bmp
- %TEMP%\aut4.tmp
- %TEMP%\RevoltG\New UI\qrmomo.bmp
- %TEMP%\aut3.tmp
- %TEMP%\RevoltG\New UI\loading_2.gif
- %TEMP%\aut2.tmp
- %TEMP%\RevoltG\New UI\loading_1.gif
- %TEMP%\autA.tmp
- %TEMP%\RevoltG\New UI\Window\Close.bmp
- %TEMP%\autB.tmp
- %TEMP%\RevoltG\New UI\Window\Closeccxcx.bmp
- %TEMP%\RevoltG\New UI\Window\socialWidget2_ico.bmp
- %TEMP%\aut14.tmp
- %TEMP%\RevoltG\New UI\Window\socialWidget_ico.bmp
- %TEMP%\aut13.tmp
- %TEMP%\RevoltG\New UI\Window\normal.bmp
- %TEMP%\aut12.tmp
- %TEMP%\RevoltG\New UI\Window\Minimize_Pressed.bmp
- %TEMP%\aut11.tmp
- %TEMP%\aut10.tmp
- %TEMP%\RevoltG\New UI\Window\Minimize_Hovered.bmp
- %TEMP%\RevoltG\New UI\Window\Minimizesss.bmp
- %TEMP%\autF.tmp
- %TEMP%\RevoltG\New UI\Window\Minimize.bmp
- %TEMP%\autE.tmp
- %TEMP%\RevoltG\New UI\Window\Close_Pressed.bmp
- %TEMP%\autD.tmp
- %TEMP%\RevoltG\New UI\Window\Close_Hovered.bmp
- %TEMP%\autC.tmp
- %TEMP%\aut15.tmp
- %HOMEPATH%\Desktop\RevoltG.lnk
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut21.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut24.tmp
- %TEMP%\aut25.tmp
- %TEMP%\aut26.tmp
- %TEMP%\aut27.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut28.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autA.tmp
- %TEMP%\autB.tmp
- %TEMP%\autC.tmp
- %TEMP%\autD.tmp
- %TEMP%\autE.tmp
- %TEMP%\autF.tmp
- %TEMP%\aut10.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut29.tmp
Network activity:
Connects to:
- '10#.#2.26.44':80
TCP:
HTTP GET requests:
- http://10#.#2.26.44//internet.txt
HTTP POST requests:
- http://10#.#2.26.44/RevoltG/n//tconfig.php
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: 'AutoIt Error'
