Home / malwarePDF  

Worm:Win32/Taterf!inf


First posted on 04 February 2009.
Source: SecurityHome

Aliases :

There are no other names known for Worm:Win32/Taterf!inf.

Explanation :

Win32/Taterf is a family of worms that spread via mapped drives in order to steal login and account details for popular online games.

Symptoms
System ChangesThe following system changes may indicate the presence of Worm:Win32/Taterf.gen:

  • Presence of any of the following files:
    amvo<number>.exe
    kavo<number>.exe
    awda<number>.exe
    avpo<number>.exe
    amvo<number>.dll
    avpo<number>.dll
    kavo<number>.dll
    <random 7 or 8 letter name>.dll
  • Where <number> may be omitted entirely, or be a numeral from 0-9

    Win32/Taterf is a family of worms that spread via mapped drives in order to steal login and account details for popular online games.

    Installation
    When executed, Taterf copies itself to the system directory as a hidden file using one of the following file names:
  • amvo<number>.exe
  • kavo<number>.exe
  • awda<number>.exe
  • avpo<number>.exe
  • The registry is modified to run the copy at each Windows start (for example):Adds value: "amva"
    With data: "<system folder>amvo<number>.exe"
    To subkey: HKCUSoftwareMicrosoftWindowsCurrentVersionRun
    Adds value: "avpa"
    With data: "<system folder>avpo<number>.exe"
    To subkey: HKCUSoftwareMicrosoftWindowsCurrentVersionRun Note: Filenames and registry modifications differ according to variant.
    The functionality to perform Taterf's password-stealing payload is contained in a dll component which is also dropped to the system directory using one of the following file names:
  • amvo<number>.dll
  • avpo<number>.dll
  • kavo<number>.dll
  • <random 7 or 8 letter name>.dll
  • Where <number> may be omitted entirely, or be a numeral from 0-9.Once dropped, the dll is injected into explorer.exe or iexplore.exe. These dlls may be detected as Worm:Win32/Taterf.<variant letter>.dll, according to variant. It should be noted, that in order to evade detection, the authors of this family may pack the worm's executable. In cases such as these, the worm may be detected with the following names:VirTool:Win32/Vanti.AVirTool:Win32/Vanti.BVirTool:Win32/Obfuscator.T A driver with a randomly generated file name may also be dropped in the %temp% directory depending on which packer is used. This driver is detected as either VirTool:WinNT/Vanti.A or VirTool:WinNT/Vanti.B. The above mentioned dlls may also be written to the %temp% directory when these packers are used.Spreads Via... Mapped DrivesThe worm continually enumerates drives from C- Z, copying itself to the root of the drive, and creating an 'autorun.inf' file. The autorun.inf is used to execute the worm whenever the drive is viewed with Windows Explorer. This file is detected as Worm:Win32/Taterf!inf. The name that the worm uses to copy itself to in the root of the drive differs across variants, however, it usually consists of random letters and numbers with a '.com', 'cmd' or an '.exe' extension.For example:q.comd.com
    d6fagcs8.cmd
    gjn2pjlw.exe
    h1dwg20.exe
    h6o0re.cmd

    Payload
    Steals Online Game Data
    Once injected, the DLL is used to obtain account information for one or more of the following Massively Multiplayer Online Games and affiliated products:Rainbow Island
    Cabal Online
    A Chinese Odyssey
    Hao Fang Battle Net
    Lineage
    Gamania
    MapleStory
    qqgame
    Legend of Mir
    World Of Warcraft

    The captured details are sent to a remote server. Modifies System SettingsThe following registry entries are modified in order to hinder detection and removal, and facilitate spreading:HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoDriveTypeAutoRunHKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedShowSuperHiddenHKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHidden
    HKLMSoftwareMicrosoftWindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALLCheckedValue
    Downloads Arbitrary FilesThe worm contacts the om7890.com domain in order to download files and update itself. Modifies System Security Settings
    The worm attempts to circumvent security products by:
  • Attempting to prevent AVP Antivirus from displaying notifications regarding system changes by closing windows used by this product.
  • Attempting to terminate Ravmon.exe if it is found to be running on the affected system.


  • Analysis by Matt McCormack

    Last update 04 February 2009

     

    TOP