Home / malware

PDF

Worm:Win32/Taterf.DM

First posted on 24 May 2010.
Source: SecurityHome

Aliases :

Worm:Win32/Taterf.DM is also known as Win32/Autorun.worm.112128.M (AhnLab), W32/Taterf.B!Generic (Authentium (Command, Trojan-GameThief.Win32.Magania.depz (Kaspersky), Trojan.PWS.Magania.AGFQ (VirusBuster), Trojan horse PSW.OnlineGames3.AJYJ (AVG), TR/PSW.Magania.depz (Avira), Trojan.Onlinegames.1140 (BitDefender), Trojan.PWS.Wsgame.13295 (Dr.Web), Win32/PSW.OnLineGames.OUM (ESET), PWS-Mmorpg!oz (McAfee), PWS:Win32/Frethog.gen!H (other), W32/Lineage.LIC (Panda), Trojan.Win32.Generic.5202AFD2 (Rising AV), W32/Autorun-BCM (Sophos), Trojan-GameThief.Win32.Magania (Sunbelt Software).

Explanation :

Win32/Taterf.DM is a worm that spread via mapped drives in order to steal login and account details for popular online games.
Top

Win32/Taterf.DM is a worm that spread via mapped drives in order to steal login and account details for popular online games. InstallationWhen executed, Win32/Taterf.DM copies itself to the system directory as a hidden file using one of the following file names:

amvo<number>.exe

kavo<number>.exe

awda<number>.exe

avpo<number>.exe

cyban.exe

xvassdf.exe

uret463.exe

herss.exe

olhrwef.exe

nodqq.exe

ahnsbsb.exe

i8ikdjwt.exe

1thes92p.exe

kva8wr.exe

aqoeerw.exe

ckvo.exe

kxvo.exe

The registry is modified to run the copy at each Windows start (for example): Adds value: "amva"
With data: "<system folder>\amvo<number>.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: "avpa"
With data: "<system folder>\avpo<number>.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Note: Filenames and registry modifications differ according to variant. The functionality to perform Win32/Taterf.DM's password-stealing payload is contained in a dll component which is also dropped to the system directory using one of the following file names:

amvo<number>.dll

avpo<number>.dll

kavo<number>.dll

cyban<number>.dll

dqq<number>.dll

cvasds<number>.dll

softqq<number>.dll

<random 7 or 8 letter name>.dll

Where <number> may be omitted entirely, or be a numeral from 0-9. Once dropped, the dll is injected into "explorer.exe" or "iexplore.exe". These dlls may be detected as Worm:Win32/Taterf.DM.<variant letter>.dll, according to variant. It should be noted that, in order to evade detection, the authors of Win32/Taterf.DM may pack the worm's executable. In cases such as these, the worm may be detected with the following names: VirTool:Win32/Vanti.A VirTool:Win32/Vanti.B VirTool:Win32/Obfuscator.T A driver with a randomly generated file name may also be dropped in the %temp% directory depending on which packer is used. This driver is detected as either VirTool:WinNT/Vanti.A or VirTool:WinNT/Vanti.B. The above mentioned DLLs may also be written to the %temp% directory when these packers are used. The Vanti detections may also drop a driver which clears the SSDT (System Service Descriptor Table, a rootkit component), in order to avoid detection. Spreads Via... Mapped removable and network drivesThe worm continually enumerates drives from C- Z, copying itself to the root of the drive, and creating an 'autorun.inf' file, which points to one of the copies that it creates. When the removable or networked drive is accessed from another computer supporting the Autorun feature, the malware is launched automatically. This 'autorun.inf' file is detected as Worm:Win32/Taterf!inf. The name that the worm uses to copy itself to in the root of the drive differs across variants, however, it usually consists of random letters and numbers with a '.com', 'cmd' or an '.exe' extension. For example: q.com d.com
d6fagcs8.cmd
gjn2pjlw.exe
h1dwg20.exe
h6o0re.cmd Payload Steals online game data
Once injected, the DLL is used to obtain account information for one or more of the following Massively Multiplayer Online Games and affiliated products:

Rainbow Island

Cabal Online

A Chinese Odyssey

Hao Fang Battle Net

Lineage

Gamania

MapleStory

qqgame

Legend of Mir

World Of Warcraft

As part of this process, Worm:Win32/Taterf.DM may monitor the following processes related to online games: amo.exe cabalmain.exe cc.exe client.exe dakerden.exe dakeron.exe dnf.exe ffclient.exe ge.exe gersang.exe goonzu.exe hevaonline.exe inphasenxd.exe knightonline.exe main.exe maplestory.exe mir3game.exe mixer.exe nida.exe so3d.exe winbaram.exe wow.exe The captured details are sent to a remote server. Modifies system settings Win32/Taterf.DM modifies the following registry modifications, which specify how hidden folders and files are displayed using Windows Explorer:HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRunHKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHiddenHKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue Downloads arbitrary filesThe worm contacts the a specific domain in order to download files and update itself. In the wild, we have observed the malware contacting the following Web sites to download arbitrary files:

om7890.com

googlew65.com

yahooui0.com

Modifies system security settings
The worm attempts to circumvent security products by:

Attempting to prevent AVP Antivirus from displaying notifications regarding system changes by closing windows used by this product.

Attempting to terminate Ravmon.exe if it is found to be running on the affected system.

Analysis by Matt McCormack

Last update 24 May 2010

 

TOP