TROJ_BUMAT.TYI

This Trojan drops malicious files onto the affected system. It

modifies the registry to ensure its execution every system activation.

It steals information related to the game Arad Senki, and sends the information via HTTP.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It steals sensitive information such as user names and passwords related to certain games.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System%\LiveHelper.dll - also detected as TROJ_BUMAT.TYI

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{1442E4D0-812A-4000-80BF-CEC0DD23A43C}

HKEY_CLASSES_ROOT\LiveHelper

HKEY_CLASSES_ROOT\LiveHelper.1

HKEY_CLASSES_ROOT\CLSID\{1442E4D0-812A-4000-80BF-CEC0DD23A43C}

HKEY_CLASSES_ROOT\Interface\{F76F3EFE-748A-42F7-98A8-F6C25A7547A3}

HKEY_CLASSES_ROOT\TypeLib\{1B9CAE19-E9FB-4646-B9AC-8169B3C39D0D}

It adds the following registry entries to install itself as a Browser Helper Object (BHO):

HKEY_CLASSES_ROOT\LiveHelper
(Default) = "Windows Live Helper"

HKEY_CLASSES_ROOT\LiveHelper\CLSID
(Default) = "{1442E4D0-812A-4000-80BF-CEC0DD23A43C}"

HKEY_CLASSES_ROOT\LiveHelper\CurVer
(Default) = "LiveHelper.1"

HKEY_CLASSES_ROOT\LiveHelper.1
(Default) = "Windows Live Helper"

HKEY_CLASSES_ROOT\LiveHelper.1\CLSID
(Default) = "{1442E4D0-812A-4000-80BF-CEC0DD23A43C}"

HKEY_CLASSES_ROOT\CLSID\{1442E4D0-812A-4000-80BF-CEC0DD23A43C}\
InprocServer32
(Default) = "%System%\LiveHelper.dll"

HKEY_CLASSES_ROOT\CLSID\{1442E4D0-812A-4000-80BF-CEC0DD23A43C}\
TypeLib
(Default) = "{1B9CAE19-E9FB-4646-B9AC-8169B3C39D0D}"

HKEY_CLASSES_ROOT\Interface\{F76F3EFE-748A-42F7-98A8-F6C25A7547A3}
(Default) = "IEyeIE"

HKEY_CLASSES_ROOT\Interface\{F76F3EFE-748A-42F7-98A8-F6C25A7547A3}\
TypeLib
(Default) = "{1B9CAE19-E9FB-4646-B9AC-8169B3C39D0D}"

HKEY_CLASSES_ROOT\TypeLib\{1B9CAE19-E9FB-4646-B9AC-8169B3C39D0D}\
1.0\0\win32
(Default) = "%System%\LiveHelper.dll"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer
xInput = "login26807230"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer
xPsd = "login55242311"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer
xSUrl = "http://www.{BLOCKED}y.com/rv.asp"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer
xUrl = "http://www.arad.jp/"

Information Theft

This Trojan steals sensitive information such as user names and passwords related to the following games:

• Arad Senki (http://www.arad.jp/)

NOTES:
It sends the gathered information via HTTP to the following URL:

• http://www.{BLOCKED}y.com/rv.asp?{login information}