Win32/Frethog

Win32/Frethog is a large family of password-stealing trojans that target confidential data, such as account information, from Massive Multiplayer Online Games (such as World of Warcraft, for example). Some variants of Win32/Frethog are also able to spread via mapped drives by utilizing an autorun file.

Win32/Frethog is a large family and variants may install themselves using different file paths and file names.

When executed, Win32/Frethog drops a dll with a randomly generated file name and injects it into explorer.exe.
 

The dropper may then modify the following registry entries in order to execute itself at each Windows start:

HKEY_CURRENT_USER\SoftWare\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SoftWare\Microsoft\Windows\CurrentVersion\Run

which packer is used. This driver is detected as either VirTool:WinNT/Vanti.A or VirTool:WinNT/Vanti.B. The above mentioned dlls may also be written to the %temp% directory when these packers are used.

Mapped Drives

Some variants of Win32/Frethog are also able to spread via mapped drives by utilizing an autorun file. TWin32/Frethog may enumerate drives from C- Z, copying itself to the root of the drive, and creating an 'autorun.inf' file. The autorun.inf is used to execute the worm whenever the drive is viewed with Windows Explorer.

Modifies System Security Settings 
The dropper attempts to circumvent security products by:

 

Steals Online Game Data
The dll, once injected, can obtain account information for one or more of the following Massively Multiplayer Online Games and affiliated products:

Rainbow Island
Cabal Online
A Chinese Odyssey
Hao Fang Battle Net
Lineage
Gamania
MapleStory
qqgame
Legend of Mir
World Of Warcraft 
 
The captured details are sent to a remote server.

 

Analysis by Matt McCormack