Prevx Research Division
WARKEY.EXE
Password StealerFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove WARKEY.EXE.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The unsafe files using this name are associated with the malware groups:
- Password Stealer
- Worm
File Behavior
WARKEY.EXE has been seen to perform the following behavior:
- Creates system tray popups, messages, errors and security warnings
- Opens browser pop ups
- Uses DNS to retrieve the IP address for web sites
- The Process is packed and/or encrypted using a software packing process
- Found on infected systems and resists interrogation by security products
- Uses low level functions to hide itself from the user and from system/security processes
WARKEY.EXE has been the subject of the following behavior:
- Executed as a Process
Country Of Origin
The filename WARKEY.EXE was first seen on Dec 13 2007 in the following geographical regions of the Webroot community:
- Spain on Dec 13 2007
- Taiwan on Sep 30 2008
- Europe on Sep 1 2009
- Turkey on Sep 1 2009
File Name Aliases
WARKEY.EXE can also use the following file names:
- KEY.EXE
- 64169028.EXE
- 56299154.EXE
Filesizes
The following file size has been seen:
- 41,472 bytes
- 49,664 bytes
- 118,784 bytes
- 184,320 bytes
- 43,008 bytes
- 69,632 bytes
- 70,144 bytes
File Type
The filename WARKEY.EXE refers to many versions of an executable program.
File Activity
One or more files with the name WARKEY.EXE creates, deletes, copies or moves the following files and folders:
- create folder C:\WINDOWS\IME\IMJP8_1\DICTS
- Opens/modifes c:\autoexec.bat
- Deletes c:\windows\fonts\msgothic.ttf
- Deletes c:\windows\fonts\msuigoth.ttf
- Deletes c:\windows\fonts\MSMINCHO.TTF
- Deletes c:\windows\fonts\Gulim.ttf
- Deletes c:\windows\fonts\Gulimche.ttf
- Deletes c:\windows\fonts\Dotum.ttf
- Deletes c:\windows\fonts\Batang.ttf
- Deletes c:\windows\fonts\Gungsuh.ttf
- Deletes c:\windows\fonts\Simsun.ttf
- Deletes c:\windows\fonts\nsimsun.ttf
- Deletes c:\windows\fonts\MingLiU.ttf
- Deletes c:\windows\fonts\pmingliu.ttf
- Creates c:\windows\system32\SET5.tmp
- Deletes c:\windows\system32\SET8.tmp
- Copies filec:\windows\system32\SET5.tmp to c:\windows\system32\SET8.tmp
- Deletes c:\windows\system32\kbd106.dll
- Moves c:\windows\system32\SET8.tmp to c:\windows\system32\kbd106.dll
- Deletes c:\windows\system32\SET5.tmp
- Creates c:\windows\system32\SETB.tmp
- Deletes c:\windows\system32\SETE.tmp
- Copies filec:\windows\system32\SETB.tmp to c:\windows\system32\SETE.tmp
- Deletes c:\windows\system32\kbd101b.dll
- Moves c:\windows\system32\SETE.tmp to c:\windows\system32\kbd101b.dll
- Deletes c:\windows\system32\SETB.tmp
- Creates c:\windows\system32\SET11.tmp
- Deletes c:\windows\system32\SET14.tmp
- Copies filec:\windows\system32\SET11.tmp to c:\windows\system32\SET14.tmp
- Deletes c:\windows\system32\kbd101c.dll
- Moves c:\windows\system32\SET14.tmp to c:\windows\system32\kbd101c.dll
- Deletes c:\windows\system32\SET11.tmp
- Creates c:\windows\system32\SET17.tmp
- Deletes c:\windows\system32\SET1A.tmp
- Copies filec:\windows\system32\SET17.tmp to c:\windows\system32\SET1A.tmp
- Deletes c:\windows\system32\kbd103.dll
- Moves c:\windows\system32\SET1A.tmp to c:\windows\system32\kbd103.dll
- Deletes c:\windows\system32\SET17.tmp
- Creates c:\windows\system32\SET1D.tmp
- Deletes c:\windows\system32\SET20.tmp
- Copies filec:\windows\system32\SET1D.tmp to c:\windows\system32\SET20.tmp
- Deletes c:\windows\system32\kbdjpn.dll
- Moves c:\windows\system32\SET20.tmp to c:\windows\system32\kbdjpn.dll
- Deletes c:\windows\system32\SET1D.tmp
- Creates c:\windows\system32\SET23.tmp
- Deletes c:\windows\system32\SET26.tmp
- Copies filec:\windows\system32\SET23.tmp to c:\windows\system32\SET26.tmp
- Deletes c:\windows\system32\kbdkor.dll
- Moves c:\windows\system32\SET26.tmp to c:\windows\system32\kbdkor.dll
- Deletes c:\windows\system32\SET23.tmp
Network Activity
One or more files with the name WARKEY.EXE performs the following network events:
- DNS Lookup127.0.0.1 0
- DNS Lookup yulv.net
- DNS Lookup122.225.27.66 yulv.net
Website Activity
One or more files with the name WARKEY.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- TCP:127.0.0.1:1055 Port:20
- Port 80 IP:122.225.27.66
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.