|Detected||Sep 26 2006 10:30 GMT|
|Released||Mar 15 2007 10:43 GMT|
|Published||Sep 26 2006 10:30 GMT|
This Trojan program is designed to steal user passwords to accounts on WoW servers. The Trojan itself is a Windows PE EXE file, written in Delphi and packed using NsPack. The packed file is 136069 bytes in size, and the unpaced file is approximately 316KB in size.
Once launched, the Trojan creates a DLL file in the C:\ root directory:
It then launches this file and calls the "start" function:
When launching, the DLL file copies its executable file to the Windows system directory:
The Trojan creates a service called NetWork Logon in order to ensure that it is automatically run each time Windows is restarted:
When launching, the DLL file gets a list of processes. It then loads itself to the address space of a process chosen at random from the list, as well as to the processes listed below:
where the DLL file will install a hook for the send function of WS2_32.dll which is used to track the user's HTTP requests. For POST requests where the URL contains the following string:
the Trojan gets the values of the following parameters:
If the URL contains the string /dologin.php, the Trojan will get the value of the parameters listed below:
For processes called WOW.EXE the Trojan gets the values entered in dialogue boxes, and will also take screenshots of some dialogue boxes.
The Trojan sends the harvested information to the remote malicious user's site.
The Trojan will also delete all links containing the string "the9.com" from the browser cache.
This type of malicious program is designed to steal user account information for online games. The data is then transmitted to the malicious user controlling the Trojan. Email, FTP, the web (including data in a request), or other methods may be used to transit the stolen data.