Trojan-GameThief.Win32.OnLineGames.blyk

Technical Details

This Trojan belongs to the family of Trojans that steals passwords from online gaming user accounts. It is a Windows application (PE EXE file). It is 16 672 bytes in size. It is packed using UPX. The unpacked file is approximately 293 KB in size. It is written in C++.

Payload

Once launched, the Trojan performs the following actions:

• For the following files:

  %System%\sfc_os.dll
  %System%\rundll32.exe
  

  the Trojan creates copies, which it saves under the following names respectively:

  %System%\mmsfc1.dll
  %System%\GTH78380.exe
  

• A function in the "mmsfc1.dll" library disables protection for the "ComRes.dll" file in the Windows system directory.
• It moves the file:

  %System%\ComRes.dll

  into the file called:

  %System%\sysGTH.dll

• It extracts the following files from its body:

  %WinDir%\fonts\comres1.ttf

  This file is 165 888 bytes in size. It is detected by Kaspersky Anti-Virus as Trojan-GameThief.Win32.OnLineGames.blyj.

  %WinDir%\fOntS\GTH78380.ttf

  This file is 35 328 bytes in size. It is detected by Kaspersky Anti-Virus as Trojan-GameThief.Win32.OnLineGames.vcpl.

  %WinDir%\fOntS\GTH78380.fon

  This file is 1312 bytes in size.

  %System%\ComRes.dll

  This file is 165 888 bytes in size. It is detected by Kaspersky Anti-Virus as Trojan-GameThief.Win32.OnLineGames.blyj.
• It terminates the following process:

  elementclient.exe

• It launches the following command:

  %System%\GTH78380.exe %WinDir%\fOnTs\comres1.ttf dns <path_to_original_body_of_trojan<
  

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
3. Delete the following files:

   %System%\mmsfc1.dll
   %System%\GTH78380.exe
   %System%\ComRes.dll
   %WinDir%\fOntS\ComRes1.ttf
   %WinDir%\fOntS\GTH78380.ttf
   %WinDir%\fOntS\GTH78380.fon
   

4. Rename the file:

   %System%\sysGTH.dll

   in the file:

   %System%\ComRes.dll

5. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: E36C2911F30D89FF7A96D0917CED8DD2
SHA1: A14E8D152AC27B5296152D8F34CEACE328F663D9

Summary

• Trojan-GameThief. Steals confidential information from games

• Trojan. Performs actions that are typical of malicious programs

Technical details

The main file is a Windows application (PE EXE file). File size of 16672 bytes. The file was packed using a special compression utility. Compression can be used for a number of reasons, including for legitimate programs. However, virus writers frequently use it to bypass antivirus protection and to make it difficult for virus analysts to analyze compressed programs Packed UPX.

Installation

Creates files on the victim machine which will be detected by Kaspersky Antivirus as:

• Trojan-GameThief.Win32.OnLineGames.blyj
• Trojan-GameThief.Win32.OnLineGames.uylb

Malicious activity

Steals A malicious program designed to steal accounts (login and password) and other information used to access multi-player games. The stolen information is sent to a cybercriminal via email, ftp, the web or other methods. The cybercriminal uses the stolen data to steal the virtual property of a player, or to commit other types of fraud.
Read more details here: http://www.viruslist.com/en/analysis?pubid=204791963confidential user information from the following games:

• Perfect World

Modifies (deletes) Windows system files