27674580903
Have_You_Ever_Chatted_With_a_Hacker_Within_a_Virus_-Hero

Written by AVG Signal Team
Published on February 5, 2016

It happened when the Threat team were researching key loggers for Diablo III while many game players playing this game found their accounts stolen.  A sample is found in battle .net in Taiwan, China. The hacker posted a topic titled “How to farm Izual in Inferno” (Izual is a boss in Diablo III ACT 4), and provided a link in the content which, as he said, pointed to a video demonstrating the means.

Screeenshot of a chat with hacker from Taiwan

Below is the ‘Video’. It’s a RAR archive actually containing two executable files. These two files are almost the same except the icon.

pictures of file icons

The malware will connect to a remote server via TCP port 80 and download a new file packed by Themida.

Screenshot of a downloader

That’s very simple Downloader/Backdoor behavior and we are only interested in looking for key logging code for Diablo III so we didn’t pay much attention to it.

But an astonishing scene staged at this time. A chatting dialog popped up with a text message (translated from the image below):

Hacker: What are you doing? Why are you researching my Trojan?

Hacker: What do you want from it?

screenshot of chat a hacker from Taiwan

The dialog is not from any software installed in our virtual machine. On the contrary, it’s an integrated function of the backdoor and the message is sent from the hacker who wrote the Trojan. Amazing, isn’t it? It seems that the hacker was online and he realized that we were debugging his baby.

screnshot of an integrated function of the backdoor

We felt interested and continued to chat with him. He was really arrogant. (Translated from the image below):

Chicken: I didn’t know you can see my screen.

Hacker: I would like to see your face, but what a pity you don’t have a camera.ascreenshot of chat a hacker from Taiwan

He is telling the truth. This backdoor has powerful functions like monitoring victim’s screen, mouse controlling, viewing process and modules, and even camera controlling.

an integrated function of the backdoor

We then chatted with hacker for some time, pretending that we were green hands and would like to buy some Trojan from him. But this hacker was not so foolish to tell us all the truth. He then shut down our system remotely.

Regarding this malware, no Diablo III key logging code was captured. What it really wants to steal is dial up connection’s username and password.

screnshot of an integrated function of the backdoor

It sounds like a movie story, but it’s real. We are familiar with malware and we are fighting with them every day. But chatting with malware writers in real time doesn’t happen so often. Next time, I will be on the alert.

The malware and its components are detected by the AVG as Trojan horse BackDoor.Generic variants.

AVG protects you and your family against online threats in today's digital world. Get global-trusted security for all your devices with AVG AntiVirus FREE for PC (download it from FileHippo), and also for your mobile phone with AVG AntiVirus for Android (download it from FileHippo).

Prevent yourself from being harmed and learn some useful tips on website safety, then brush up on the world's most famous hackers operating today. If you’ve already been infected, read our guide on how to remove a virus from your computer

Protect your Android against threats with AVG AntiVirus

Free install

Protect your iPhone against threats with AVG Mobile Security

Free install
Hackers
Privacy
AVG Signal Team
5-02-2016