TROJ_GAMETHI.FMS

This Trojan may be downloaded by other malware/grayware from remote sites.

As of this writing, the said sites are inaccessible.

It steals sensitive information such as user names and passwords related to certain games.

It creates an event. It deletes itself after execution.

Arrival Details

This Trojan may be downloaded by the following malware/grayware from remote sites:

• JS_SHELLCOD.SMGU

Installation

This Trojan drops the following copies of itself into the affected system:

• %system%{5 random characters}.exe

It injects itself into the following processes as part of its memory residency routine:

• EXPLORER.EXE

Autostart Technique

This Trojan modifies the following entry(ies) to allow itself to run on safe mode:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = %system%\userinit.exe,aoots.exe

(Note: The default value data of the said registry entry is %system%\userinit.exe,.)

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• ALUSCHEDULERSVC.EXE
• ASHDISP.EXE
• AVGNT.EXE
• AVGRSX.EXE
• AVP.EXE
• AYAGENT.AYE
• AYUpdate.aye
• EKRN.EXE
• SfFnUp.exe
• UFSEAGNT.EXE
• UfUpdUi.exe
• VSTSKMGR.EXE
• avast.setup
• avgupd.exe
• luall.exe
• mcupdate.exe
• preupd.exe
• setup.ovr
• update.exe

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• www.{BLOCKED}hhuo.net/mljs11/heihaahhuo.png
• 23weer.7{BLOCKED}.com/23weer/23weer.gif

As of this writing, the said sites are inaccessible.

Information Theft

This Trojan steals sensitive information such as user names and passwords related to the following games:

• Maple Story
• Dungeon Fighter
• Ragnarok Online
• World of Warcraft
• Twelve Sky 2
• Red Stone
• Tales Weaver
• FIFA

Other Details

This Trojan does the following:

• Checks the language by querying on the following registry:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language
  If Chinese, it does not continue with its routines.
• Obtains user account details from the above-mentioned games by monitoring the following processes:
  • maplestory.exe
  • arad.exe
  • ragexe.exe
  • ragurdrexe.exe
  • wow.exe
  • gersang.exe
  • twelvesky2.exe
  • RedStone.exe
  • InphaseNXD.exe
  • dnf.exe
  • ff2client.exe
  • _beanfuncore.exe
  • elementclient.exe
  • ragfree.exe
  • pcotp.exe

It creates the following event(s):

• MN_XADLEBDGTWUIAIHDIIASDOOAOIDCDDD0
• DWONS_ASMAPING_BCGFATTQYGUADUUYATYM

It deletes itself after execution.