virus logo Virus

W32/OnlineGames!tr

description-logoAnalysis


  • It copies itself to the Windows folder using a random filename.

  • It drops a DLL file with a random filename in the System folder.

  • It adds the following registry:
    • key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • value:AppInit_DLLs
    • data: {RANDOM}.dll
    • key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • value:{RANDOM}
    • data: {RANDOM}.exe
    Note: {RANDOM}.dll and {RANDOM}.exe are the dropped files of the malware.

  • Searches for the following online games and steals their account information:
    • YouXiChaYuan
    • Perfect World
    • World Of Warcraft
  • The stolen information is sent to the following URL:
    • http://www.ck{REMOVED}.com/wow5566/lin111.asp
  • Injects code into the process explorer.exe.

    • recommended-action-logoRecommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
      FortiClient Systems
    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Telemetry logoTelemetry

    Detection Availability

    FortiGate
    Extended
    FortiClient
    FortiMail
    FortiSandbox
    FortiWeb
    Web Application Firewall
    FortiIsolator
    FortiDeceptor
    FortiEDR

    Version Updates

    Date Version Detail
    2022-05-25 90.02623
    2022-05-25 90.02622
    2022-03-29 90.00912
    2021-11-30 89.07343
    2021-11-23 89.07133
    2021-10-26 89.06291
    2021-10-12 89.05871
    2021-09-28 89.04210
    2021-09-28 89.04190
    2021-09-26 89.03730
    ID 347958
    Released Apr 12, 2007
    Description
    Updated    		 Jul 14, 2008
    Aliases Trojan-PSW.Win32.OnLineGames.oe (KAV), Win32/PSW.Agent.NCC (NOD32), PSW.Generic3.VNO (AVG), W32/OnLineGames.AME!tr, OnlineGames.BD!tr.pws, W32/OnlineGames.BD!tr.pws
    Platform Profile Win32 file format / PE 32 bit