Categories: Malware

PWS:Win32/Frethog.B (file analysis)

The PWS:Win32/Frethog.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Frethog.B virus can do?

Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
Enumerates running processes
Expresses interest in specific running processes
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Deletes its original binary from disk
Code injection with CreateRemoteThread in a remote process
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Installs itself for autorun at Windows startup

How to determine PWS:Win32/Frethog.B?


File Info:
name: 5B44B1141B3FCB28F86A.mlwpath: /opt/CAPEv2/storage/binaries/cd32f9d19af793e671f8a9ae80b9919a9067b5ef46c0f0ae93a77471a0b0f062crc32: 4079059Amd5: 5b44b1141b3fcb28f86a106ba37bb8afsha1: f66f6fbdccb1af33890fe88b4476164942076cdfsha256: cd32f9d19af793e671f8a9ae80b9919a9067b5ef46c0f0ae93a77471a0b0f062sha512: c596f98c3c964c442aa7a5ae11d8dc14758390934e0596e989d6503eb526d5bd2f3722543c4635dd625447ebb6ea9c93edac7eba9daa1c26b13c78213bbd1269ssdeep: 192:2v3D2E+OI7jDoGyGPOPOinlLJP1oynDiomlQhOCgyU00:2vKOI7ozGinlx1Yf0OOU00type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T103421A4767A418F3C1CE06B039775EB99BB50078132694E3C73397C568B0B92EC1B60Bsha3_384: 3a814c70df079b8fe1e16d6222bcfb245c1c609c6e6567e94c66e80a2e62d3ba5d705f4b2141957786a7df7d4157e458ep_bytes: 558bec6aff683821400068f019400064timestamp: 2007-05-08 15:17:58
Version Info:
0: [No Data]

PWS:Win32/Frethog.B also known as:

Lionic	Trojan.Win32.OnLineGames.l3SI
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Wsgame
MicroWorld-eScan	Generic.Malware.S!dld!g!PWS!.43FE67F5
FireEye	Generic.mg.5b44b1141b3fcb28
ALYac	Spyware.OnlineGames.Gen
Cylance	Unsafe
Zillya	Trojan.OnLineGames.Win32.127896
Sangfor	Trojan.Win32.Save.a
Alibaba	TrojanPSW:Win32/OnLineGames.2aa342e7
Cybereason	malicious.41b3fc
BitDefenderTheta	AI:Packer.9A7A28A21F
Cyren	W32/OnlineGames.T.gen!Eldorado
Symantec	Infostealer.Gampass
ESET-NOD32	a variant of Win32/PSW.Agent.NCC
TrendMicro-HouseCall	TSPY_ONLINEG.IA
ClamAV	Win.Spyware.7423-2
Kaspersky	Trojan-GameThief.Win32.OnLineGames.wzm
BitDefender	Generic.Malware.S!dld!g!PWS!.43FE67F5
NANO-Antivirus	Trojan.Win32.OnLineGames.kpuv
ViRobot	Trojan.Win32.PSWIGames.12288.V
Avast	Win32:OnLineGames-ACB [Trj]
Tencent	Win32.Trojan-gamethief.Onlinegames.Swky
TACHYON	Trojan-PWS/W32.WebGame.12288.CP
Comodo	TrojWare.Win32.PSW.OnLineGames.~HG@fb0ym
VIPRE	RiskTool.Win32.ProcessPatcher.Sml!cobra (v) (not malicious)
TrendMicro	TSPY_ONLINEG.IA
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.lt
Emsisoft	Generic.Malware.S!dld!g!PWS!.43FE67F5 (B)
Ikarus	Trojan-PWS.Win32.OnLineGames
Jiangmin	Trojan/Agent.cws
Webroot	W32.Malware.Gen
Avira	TR/Drop.Online.rt.2
Antiy-AVL	Trojan/Generic.ASMalwS.9671A6
Microsoft	PWS:Win32/Frethog.B
ZoneAlarm	Trojan-GameThief.Win32.OnLineGames.yas
GData	Generic.Malware.S!dld!g!PWS!.43FE67F5
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.OnlineGameHack.R4178
McAfee	PWS-LegMir.gen.b
MAX	malware (ai score=100)
VBA32	MalwareScope.Trojan-PSW.Game.1
APEX	Malicious
Rising	Trojan.PSW.OnlineGames.bdn (CLOUD)
Yandex	Trojan.GenAsa!e4mVV7MFp/4
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/OnLineGames.NW!tr.pws
AVG	Win32:OnLineGames-ACB [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)