Threat Database Trojans Trojan.PWS.Onlinegames.X

Trojan.PWS.Onlinegames.X

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 19,038
Threat Level: 80 % (High)
Infected Computers: 4
First Seen: September 2, 2023
Last Seen: June 15, 2026
OS(es) Affected: Windows

The detection of Trojan.PWS.Onlinegames.X indicates that your system has been compromised by a type of Trojan horse malware. This type of threat is designed to remain hidden on a victim's computer, allowing an attacker to gain unauthorized access and control. It's essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.

What Is Trojan.PWS.Onlinegames.X?

Trojan.PWS.Onlinegames.X is a type of malware that falls under the category of Trojans, which are malicious programs that disguise themselves as legitimate software. The name suggests that it may be related to online gaming, but its actual impact and behavior can be more widespread. Trojans like this one are often used to steal sensitive information, such as login credentials, credit card numbers, and other personal data. They can also be used to install additional malware, create backdoors for remote access, and disrupt system operations.

How Trojan.PWS.Onlinegames.X Operates

Once installed on a system, Trojan.PWS.Onlinegames.X can operate in various ways, depending on its intended purpose. It may start by scanning the system for valuable data, such as saved passwords, browsing history, and other sensitive information. It can also communicate with its command and control servers to receive updates, instructions, or to send stolen data back to the attackers. The malware may use various techniques to evade detection, including code obfuscation, anti-debugging methods, and exploiting vulnerabilities in software and operating systems.

Symptoms of Infection

Identifying a Trojan infection can be challenging, as these malware types are designed to remain stealthy. However, some common symptoms may indicate the presence of Trojan.PWS.Onlinegames.X or similar malware. These include unexpected system crashes, slow performance, unusual network activity, and unfamiliar programs or icons on the desktop. Users may also notice that their personal data is being stolen or misused, such as unauthorized login attempts or unexpected transactions on their accounts.

  • Unexplained changes in system settings or configuration
  • Appearance of unwanted software or tools
  • Increased risk of other malware infections due to compromised system security
  • Difficulty in installing security updates or running antivirus software

How to Remove Trojan.PWS.Onlinegames.X

  1. Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
  2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all traces of the malware.
  3. Uninstall any suspicious programs or applications that were installed without your knowledge or consent.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or settings.
  5. Reboot your computer and run another scan with your anti-malware software to ensure that all remnants of the malware have been removed.

Conclusion

Removing Trojan.PWS.Onlinegames.X requires careful and immediate action to prevent further damage to your system and to protect your personal data. By following the steps outlined above and maintaining good security practices, such as keeping your operating system and software up to date, using strong and unique passwords, and being cautious when downloading and installing software, you can significantly reduce the risk of future infections. Remember, the key to dealing with malware is vigilance and prompt action to mitigate its impact and remove it from your system.

Analysis Report

General information

Family Name: Trojan.PWS.Onlinegames.X
Signature status: No Signature

Known Samples

MD5: 539a61fe4bf97517d8ff027dfa4abb6b
SHA1: e67ddfe2fc93cc24e5eee732e48f1a1dd7d61885
SHA256: 3A4E5E3076DB89E35A865D66D64E04E86B0C2E8F507ADB353ABBA4D65D39DADF
File Size: 204.80 KB, 204800 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have security information
  • File has exports table
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
File Description 辅助设计工具
File Version 1, 0, 0, 1
Internal Name AdTool
Legal Copyright Copyright 2010
Original Filename YJT_AdTool.arx
Product Name YJT
Product Version 1, 0, 0, 1

File Traits

  • dll
  • x86

Block Information

Total Blocks: 98
Potentially Malicious Blocks: 22
Whitelisted Blocks: 36
Unknown Blocks: 40

Visual Map

? ? ? ? ? 0 ? 0 0 0 ? 0 0 0 0 0 ? 0 ? x 0 0 0 x 0 0 ? x 0 0 ? ? 0 0 ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 x ? x x x x x x x x x x x x x x x x x x ? ? 0 0 1 0 0 0 1 1 0 0 0 0 ?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e67ddfe2fc93cc24e5eee732e48f1a1dd7d61885_0000204800.,LiQMAxHB

Related Posts

Trending

Most Viewed

Loading...