Categories: Malware

What is “PWS:Win32/Lmir.O”?

The PWS:Win32/Lmir.O is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Lmir.O virus can do?

Sample contains Overlay data
Uses Windows utilities for basic functionality
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Checks for the presence of known windows from debuggers and forensic tools
Creates a copy of itself
Deletes executed files from disk
Yara detections observed in process dumps, payloads or dropped files

How to determine PWS:Win32/Lmir.O?


File Info:
name: D5A588D74E9FCA84F20F.mlwpath: /opt/CAPEv2/storage/binaries/51acb24a4de415f8b7e10d2aba3bcc0db7dcd2717852df741f060eea828f2754crc32: 8D6F0EE9md5: d5a588d74e9fca84f20f9022b6830332sha1: a73f0eaa175022b6e53feb07d1b8f05bc50b2d26sha256: 51acb24a4de415f8b7e10d2aba3bcc0db7dcd2717852df741f060eea828f2754sha512: 2bdec445932e42d8e30d61320b0c4e1e56d9e03d982b6b8457a8c593df6d7abd125d36c8a20a1d24875a4ea2ab8c3222e7102a0e5e82bffcfe76642930c4ca01ssdeep: 768:nekUKO6OhIAzVJHrLT/fQ6q2a10F9ZLzfnUhZ8cj8YudBAPHInKKVF:TUKAiAVJHrLT/fLU98TM6KKtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T12E438E875B5AD8F3C2E50ABD31E626034FB6BE300EAA48C7DBFBA6C566704474924507sha3_384: e9ee5b11162e030c9e7189c5e62b0e8304623005d4daeea4168fb160dc618148e73172a296103c03ad585668ba359ee3ep_bytes: 558bec6aff68d020400068801a400064timestamp: 2008-09-02 11:38:03
Version Info:
0: [No Data]

PWS:Win32/Lmir.O also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.kZcP
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Trojan.PWS.OnlineGames.ZWU
ClamAV	Win.Spyware.52254-2
FireEye	Generic.mg.d5a588d74e9fca84
CAT-QuickHeal	Trojanpws.Lmir.27096
Skyhigh	BehavesLike.Win32.Generic.qt
McAfee	generic!bg.ffl
Malwarebytes	MachineLearning/Anomalous.100%
Zillya	Trojan.OnLineGames.Win32.93907
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanPSW:Win32/OnLineGames.34106716
K7GW	Trojan ( 004bcce41 )
K7AntiVirus	Trojan ( 004bcce41 )
BitDefenderTheta	Gen:NN.ZexaF.36744.dqX@aCIgQHnb
Symantec	Infostealer
ESET-NOD32	a variant of Win32/PSW.OnLineGames.NXI
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-GameThief.Win32.OnLineGames.tgph
BitDefender	Trojan.PWS.OnlineGames.ZWU
NANO-Antivirus	Trojan.Win32.OnLineGames.bxotz
Avast	Win32:Susn-K [Trj]
Tencent	Malware.Win32.Gencirc.14012fb3
Emsisoft	Trojan.PWS.OnlineGames.ZWU (B)
Baidu	Win32.Trojan-PSW.OLGames.by
F-Secure	Trojan.TR/Spy.Gen
DrWeb	Trojan.MulDrop4.226
VIPRE	Trojan.PWS.OnlineGames.ZWU
TrendMicro	Mal_OLGM-15
Trapmine	malicious.high.ml.score
Sophos	Mal/Zhengtu-A
SentinelOne	Static AI – Malicious PE
GData	Trojan.PWS.OnlineGames.ZWU
Jiangmin	TrojanSpy.OnLineGames.bvw
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/Spy.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan[GameThief]/Win32.OnLineGames
Kingsoft	Win32.Troj.OnLineGamesT.ba.61440
Xcitium	TrojWare.Win32.PSW.OnlineGames.~AXZ@18ktm
Arcabit	Trojan.PWS.OnlineGames.ZWU
ZoneAlarm	Trojan-GameThief.Win32.OnLineGames.tgph
Microsoft	PWS:Win32/Lmir.O
Varist	W32/OnlineGames.AS.gen!Eldorado
Acronis	suspicious
VBA32	BScope.TrojanSpy.Treemz
ALYac	Trojan.PWS.OnlineGames.ZWU
Cylance	unsafe
Panda	Trj/Lineage.JPT
TrendMicro-HouseCall	Mal_OLGM-15
Rising	Trojan.PSW.Win32.GameOL.peb (CLASSIC)
Yandex	Trojan.PWS.OnLineGames!uKq4lswOwOI
Ikarus	Trojan.Agent
MaxSecure	Trojan.Malware.1136865.susgen
Fortinet	W32/Dropper.GE!tr
AVG	Win32:Susn-K [Trj]
Cybereason	malicious.a17502
DeepInstinct	MALICIOUS