Taterf

Overview

Worm:Win32/Taterf is a highly prevalent, self-replicating worm primarily designed to steal login credentials for popular Massively Multiplayer Online Role-Playing Games (MMORPGs) like World of Warcraft and Lineage. It gained massive notoriety for its aggressive propagation mechanisms, particularly its reliance on infecting removable USB drives and traversing open network shares.

Understanding Taterf (USB Worms)
To an end-user, a Taterf infection might go unnoticed until their valuable online gaming accounts are compromised and stripped of virtual assets. For a network administrator, Taterf is a severe nuisance that highlights poor network segregation and the dangers of unmanaged removable media. While its primary goal is gaming credential theft (`T1003`), its propagation methods cause significant 'background noise' and risk on corporate networks.

Execution and Propagation Mechanics
Taterf spreads aggressively via Lateral Movement. When an infected USB drive is inserted into a machine, Windows AutoRun (if enabled) automatically executes the worm (`T1091`). Once active, the worm copies itself to the Windows system folder and establishes persistence via the Registry Run keys (`T1547.001`). It then continually monitors for newly inserted USB drives, copying itself and a hidden `autorun.inf` file to them. Furthermore, it actively scans the local network for open SMB shares, attempting to copy its executable to any accessible network drives (`T1080`). To protect itself, Taterf attempts to terminate processes associated with popular antivirus and analysis tools (`T1562.001`).

Indicators of Compromise & Impact
The primary impact is credential theft and network congestion. Host-based IoCs include the presence of `autorun.inf` files and hidden executables on the root of USB drives, and anomalous registry modifications ensuring startup. EDR solutions may flag the worm's attempts to forcefully terminate security processes. Network IoCs include excessive SMB traffic attempting to write executables to shared drives.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_TATERF {
    meta:
        description = "Detects Taterf (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "taterf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Taterf Activity
id: 9ba21d982e031d5fe1fd8bd92a24b7d2
status: experimental
description: Detects generic indicators of the taterf malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*taterf*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Globally disable the Windows AutoRun / AutoPlay feature via Group Policy to immediately halt the primary propagation vector.
2. Restrict write access to root network shares and monitor for the creation of unauthorized executable files.
3. Run a comprehensive AV scan across all endpoints and actively sanitize any inserted USB drives.
4. Enforce strict network segmentation to limit the worm's ability to scan and infect adjacent subnets.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not simply delete the worm from a single endpoint without sanitizing associated USB drives; reinfection will occur immediately upon reinsertion.
2. Avoid allowing unrestricted SMB file sharing across the entire enterprise, as this enables rapid worm propagation.

References & External Analysis

• Search "taterf" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Logicielsespions
• Kingsoft
• Garrun
• Aliser
• Nottotrack

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/taterf.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.