Recently, 360 brain of Safety intercepted and killed a new worm that spread through the Warcraft game map. As long as the player selects a map with the worm in the game platform, the worm infects the player’s computer. Even more frightening is that this worm will further infect other normal game maps on the player’s computer. If not detected in time, the virus may cause a large area of infection in the shortest possible time.

After the deep trace analysis of 360 Brain of Safety, it was found that the C&C domain name used by the worm author had the word lucky2048, so the worm was named “lucky worm”. Moreover, after monitoring the new virus, 360 Brain of Safety has achieved comprehensive killing in the first time, and computer users with 360 Total Security can ensure innocence.

According to the monitoring data of 360 Brain of Safety, from the middle of March 2019, the “lucky” worm began to spread and spread rapidly. Up to 27th April, more than 200,000 computers have been attacked.

The principle of the virus launching the attack is that when the user creates a game room with a virus map, the game map will be automatically synchronized. When the player in the room starts the game, the map starts to release the virus code. The player computer that was not infected with the virus will be unfortunately recruited, and the normal map in the player’s computer will be infected with virus. In this way, the spread of ten, ten pass, the virus will spread quickly.

The virus inserts a piece of code into the map’s war3map.j script to execute the malicious module it pulls in.

Once the player computer is infected with the “lucky worm”, when the user uses this computer to play the game, the virus will brush the page in the background and earn advertising traffic fees. This operation will also crowd out system resources and greatly affect the user’s gaming experience. Even more disturbing is that the virus also has remote execution capabilities, and not to rule out more attacks.

According to the statistics from 360 Brain of Safety, this “lucky worm” will affect the “Warcraft 3 – Frozen Throne” the version before v1.30 . Since many gamers love the previous classic version and have not updated the version, it is easy to encounter an attack without knowing it.

For the serious situation of the “lucky” worm spreading, 360 Brain of Safety recommend:

1. It is recommended that the majority of Warcraft players update their game versions as soon as possible to avoid being exploited by viruses without their knowledge.
2. Go to www.360totalsecurity.com in time to install the latest version of 360 Total Security, which can effectively protect users and protect users during the game.

IOCS：