Online Game Trojan SecurityLabs.websense.com Hermes Li

Contents Why game trojans is so popular 1 The underground market operation 2 Analysis of an online game trojan 3 How to protect against trojans 4 Download link (deepsec)

Internet Status in China  Total internet users in China  485 Milion, 36.2% amone total population  Internet users encounter with the Trojan  217 Milion, 44.7% amone Total internet users in China  Affected users  121 Milion, 24.9% amone Total internet users in China once lost there account by trojan's attack Data from CNNIC, up to Jun 2011

Online Game Players in China  Online gaming market  More than RMB 34.9 Billion (EUR 4 Billion)  Total number of game players  311 million. active player: more than120 million  Personal spending for online game  Representative cost on average RMB 99 per player per month

Normal Online Game Market Inside Game Outside Game

Virtual Goods Selling AD ADs screen shot (in Chinese character)

The Underground Market Operation Game Player Account Retailer Trojan Buyer Trojan Writer Major target: Massive Multiplayer Online Role Playing Games like World of Warcraft 1 Trojan = 100RMB 1000 account = 500RMB 1 top leavel sword> 10,000RMB

personal Server Cracked Software Social Network Malicious Websites Cheating Program Where Are Game Trojans From

How Trojan Installed Compromised site Bad guy Black SEO Social networks IM chats Victim Client Trojan Downloader Victim DB Account Data Crafted website Trojan

Analysis of a Game Trojan Framework  How to generate a trojan  The work process of the trojan  Source code of module component

Detection Rate Example

Generate Trojan Packed trojan file Stolor.dll IMEHost.dll AddNewSection.exe Generator.exe to pack with upack DllHost.dll

C:\windows\System32 Work Process Run Injected system files comres.dll ddraw.dll dsound.dll dbr01021.ocx dbr99005.ocx winnt.com stolor.dll IMEhost.dll dllhost.dll Trojan.exe C:\windows32\fonts\dbr01021.ttf

3 Modules to Monitor Game Infect Infect system dlls (dsound.dll,ddraw.dll, d3dx.dll, comres.dll) under System folder, add a new session IME Release a fake font file as config file Register a fake Input Method and set to default Hook Call API CreateRemoteThread or SetWindowsHookEx. Hook game exe file’s process and append trojan dll thread.

Module Component (Hook) SetWindowsHookEx (DllHost.cpp)

Module Component (Hook) CreateRemoteThread (Funcs.cpp)

Module Component (IME) Append fake IME to system and set as default (IMEHost.cpp)

Module Component (IME) Export Function (IMEHost.cpp IMEHost.def)

Module Component (Infect) Kill game process and Infect system dll file (StoreMain.cpp)

Module Component (Infect) Infect and encrypt new added session (Infect.cpp, Pecrypt.cpp)

Special Functions AntiAV (AntiAV.cpp)AdjustPrivileges (Func.cpp)

Special Functions Grid Authentication Crack (KickProc.cpp)

Grid Authentication Crack  grid card screen shots

Special Functions Grid Authentication Crack (CapPic.cpp)

 Type of trojans  Advanced hidden technology  Anti-Detection technology  Prediction solution More About All Trojans

Type of Trojans Act in Advanced Persistent Threats Trojans to steal bank account directly, real money damage Back door program to monitor IM, or other accounts, or remote controller APT Trojan Bank Trojan Game Trojan Common Trojan Hackers use this to steal game account and sale out to get money

Advanced Hidden Technology Hide file Monitor system API ZwQueryDirectoryFile, remove itself from files list. API Hook Modify result lists (Root kit) Hide process Hook processes list API EnumProcesses, remove itself from result.

Anti Detection Tech Corecodes encryption Packer Obfuscation

Prediction Solution for Enterprise Real-Time Security Scan(both content and URL) IP Overblock / Domain Overblock Outbound and Inbound traffic scanning Reputation score Advanced Detection