Author Topic: Chinese Gaming Trojans  (Read 3294 times)

0 Members and 1 Guest are viewing this topic.

May 03, 2008, 03:34:11 pm
Read 3294 times

steven

  • Newbie

  • Offline
  • *

  • 3
    • Shadowserver Foundation
Many of these have been around for a while and spread through interesting means.  I believe these often come by way thumb drives (auto-run stuff) and are frequently found in Asia.  The last time I checked on one of these they targeted credentials for specific games that I had never heard of, however, these could be updated for all I know.  These URLs are what the trojan pulls for updates.

hxxp://www.om7890.com/fm4/help.exe
hxxp://www.om7890.com/fm4/help.rar
hxxp://www.hg7890.com/hg2/ll.exe
hxxp://www.hg7890.com/hg2/ll.rar
hxxp://www.gamesrb.com/rbv/uu.exe
hxxp://www.gamesrb.com/rbv/uu.rar
hxxp://www.microsoftmg.com/gut/mgg.exe
hxxp://www.microsoftmg.com/mfx/vap.exe


Domains/IPs:

om7890.com [60.169.1.92]
hg7890.com [60.169.2.226]
gamesrb.com [60.169.2.226]
microsoftmg.com [60.169.2.240]

May 04, 2008, 12:06:43 am
Reply #1

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964