Dissecting the XWM Trojan Kit a Peek at China’S Growing Underground Online Gaming Economy
Total Page:16
File Type:pdf, Size:1020Kb
Dissecting the XWM Trojan Kit A Peek at China’s Growing Underground Online Gaming Economy Trend Micro, Incorporated Lion Gu Senior Threat Researcher A Trend Micro Research Paper I September 2010 Dissecting the XWM Trojan Kit A Peek at China’s Growing Underground Online Gaming Economy CONTENTS Introduction .............................................................................................................................................. 3 XWM Kit Overview .................................................................................................................................... 4 Trojan Generator ...................................................................................................................................... 6 XWM Trojans and Their Components .................................................................................................... 7 Back-End Server ....................................................................................................................................... 9 More About XWM ..................................................................................................................................... 13 Conclusion ................................................................................................................................................14 References ................................................................................................................................................16 2 RESEARCH PAPER I DISSECTING THE XWM TROJAN KIT: A PEEK AT CHINA’S UNDERGROUND ONLINE GAMING ECONOMY Dissecting the XWM Trojan Kit A Peek at China’s Growing Underground Online Gaming Economy INTRODUCTION As of December 2009, Online games are very popular in China. around 265 million or In fact, as of December 2009, around 68.9 percent of the total 265 million or 68.9 percent of the total number of Internet users number of Internet users in China in China played online played online games. At same time, games. There are there are 750 online game vendors in 750 online game China whose total revenue amounts to vendors in China whose around RMB 25 billion. total revenue amounts to around RMB 25 billion. Players spend not only a lot of time but also money to play online games. To enhance their online gaming experience, players shell out money to purchase virtual assets like gold, artifacts, and the like as well as services like power leveling, gold farming, and others via real money trading (RMT) on several online trading platforms. Most of the online trading platforms are open marketplaces wherein anyone can buy and sell virtual assets or services using convenient payment methods. These have made the RMT market bigger, resulting in a virtual asset revenue of around RMB 34 billion in 2009. Cybercriminals do not want to miss out on a huge opportunity so they created a Trojan kit to steal players’ account credentials and to sell the virtual assets the players have accumulated over time. This allowed the cybercriminals to more easily acquire money and made online gaming Trojans a big security threat in China. The proliferation of online gaming Trojans changed the underground community. New roles in the underground community emerged such as site crackers who insert Trojan download URLs into sites as well as virtual asset stealers and sellers. This research paper introduces a popular online gaming Trojan kit known as the “Xiang Wei Ma (XWM) Kit,” which roughly translates to “Rattle Trojan,” that targets popular online games in China. 3 RESEARCH PAPER I DISSECTING THE XWM TROJAN KIT: A PEEK AT CHINA’S UNDERGROUND ONLINE GAMING ECONOMY Dissecting the XWM Trojan Kit A Peek at China’s Growing Underground Online Gaming Economy XWM KIT OVERVIEW The XWM Kit includes 21 Trojan generators with back-end server components, each of which targets a popular online game in China. Most of the targeted games are local Chinese online games. Figure 1. XWM Kit Trojan generators The XWM Kit, in particular, targets the following Chinese online games: QQ华夏 or QQ Hua Xia 大话3 or Da Hua 3 QQ华夏 or QQ Hua Xia 大话西游 or Da Hua Xi You QQ幻想 or QQ Huan Xiang 刀剑 or Dao Jian 赤壁 or Chi Bi 地下城勇士 or DNF 传奇外传 or Mir 风火之旅 or Fantasy Journey 4 RESEARCH PAPER I DISSECTING THE XWM TROJAN KIT: A PEEK AT CHINA’S UNDERGROUND ONLINE GAMING ECONOMY Dissecting the XWM Trojan Kit A Peek at China’s Growing Underground Online Gaming Economy 风云 or Feng Yun 奇迹世界 or Soul of the Ultimate Nation 封神2 or Feng Shen 2 热血江湖 or Re Xue Jiang Hu 剑侠世界 or Jian Xia Shi Jie 天龙八部 or Tian Long 巨人 or Ju Ren 完美世界 or Wan Mei 梦幻西游 or Meng Huan Xi You 问道 or Wen Dao 魔兽 or World of Warcraft The back-end server is a The back-end server is a website that the Trojan sends stolen information to. website that the Trojan Cybercriminals use this site as storage for stolen data, prompting them to call it sends stolen information their “mailbox.” to. Figure 2. XWM Kit’s back-end server components 5 RESEARCH PAPER I DISSECTING THE XWM TROJAN KIT: A PEEK AT CHINA’S UNDERGROUND ONLINE GAMING ECONOMY Dissecting the XWM Trojan Kit A Peek at China’s Growing Underground Online Gaming Economy TROJAN GENERATOR The XWM Kit’s Trojan generator needs to be configured before it can be used to generate a new Trojan. Users need to input the back-end server’s URL into the kit’s configuration module in order to receive the information that the Trojans they created steal. Figure 3. XWM Kit’s configuration window The said configuration module also has a compression option. This gives users the option to either compress the Trojans they generate or not. The XWM Kit uses a packer called “Upack” to compress the Trojans the malicious users create. Figure 4. Upack is used to compress the Trojans created using the XWM Kit After clicking the Generate button, the XWM Kit will generate a new Trojan, an .EXE file. 6 RESEARCH PAPER I DISSECTING THE XWM TROJAN KIT: A PEEK AT CHINA’S UNDERGROUND ONLINE GAMING ECONOMY Dissecting the XWM Trojan Kit A Peek at China’s Growing Underground Online Gaming Economy XWM TROJANS AND THEIR COMPONENTS When the XWM Trojans are executed, it drops the following files onto affected systems: • %system32%\{4 random characters}.dll • %system32%\{4 random characters}.cfg • %system32%\drivers\msacpe.sys The malicious routine of XWM Trojans is quite simple. They first drop a .DLL and a .CFG file onto the affected system, both of which use four random characters as names. They then load the .DLL file onto the system’s memory. This file has the following main functions: • Terminate security software processes. It will terminate several processes related to 360, a Chinese security software vendor. • Drop a driver file and create a service related to it. It will drop a driver file named msacpe.sys then create a service named mseqsv that uses the former as image file. This acts as a network sniffer for the malware, allowing it to steal information off an affected system. • Steal online gaming information. To do this, it will search for online gaming configuration files like config.ini, info.ini, and others, which contain the following information: • User names • Online game server names • Areas where the online game servers are located It will then search for processes related to online gaming and read their memory spaces in order to steal the following information: • Game roles • Game levels • Amount of virtual money Once, msacpe.sys finds processes related to its target online games, it will inject its code into the processes then retrieve information such as passwords from the said processes. 7 RESEARCH PAPER I DISSECTING THE XWM TROJAN KIT: A PEEK AT CHINA’S UNDERGROUND ONLINE GAMING ECONOMY Dissecting the XWM Trojan Kit A Peek at China’s Growing Underground Online Gaming Economy • Send stolen information to the back-end server. It can also send stolen information to the back-end server that the cybercriminals own. It uses the following string as URL argument: ?a=%s&s=%s&u=%s&p=%s&r=%s[%s]&l=%d&m=%d&pin=%s The above-mentioned argument has eight variables, namely: • a = area where the online gaming server is located • s = server name • u = user name • p = password • r = role • l = level • m = virtual money • pin = personal identification number (PIN) code The Trojan will use the said argument to send stolen information back to the back- end server. The msacpe.sys file assists the .DLL file in stealing information. The .CFG file thus only contains the encrypted back-end server’s URL, which is inputted when configuring the Trojan generator. 8 RESEARCH PAPER I DISSECTING THE XWM TROJAN KIT: A PEEK AT CHINA’S UNDERGROUND ONLINE GAMING ECONOMY Dissecting the XWM Trojan Kit A Peek at China’s Growing Underground Online Gaming Economy BACK-END SERVER ASP was Microsoft’s The back-end server receives the information that the Trojan steals. It is a website that first server-side script uses the Active Server Pages (ASP) technology. To test the malware, we set up a site engine for dynamically using Internet Information Services (IIS). As shown, the back-end server requires a user generated Web pages. name and a password to log someone in. Initially released as an add-on to IIS via the Windows NT 4.0 Option Pack, it was subsequently included as a free component of Windows 2000 Server. Figure 5. Back-end server’s login page The back-end server has four main functions, namely: • Checks stolen information • Administers power users • Administers normal users • Reviews the server’s visit history Figure 6. Four main functions of the back-end server 9 RESEARCH