Categories: Trojan

Trojan.PWS.Onlinegames.KEGA (file analysis)

The Trojan.PWS.Onlinegames.KEGA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.PWS.Onlinegames.KEGA virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.PWS.Onlinegames.KEGA?


File Info:
name: 3A39B30358C4115951AE.mlwpath: /opt/CAPEv2/storage/binaries/7880c95cb51d106ff88e4fdc53c08d84523f443599b56ca2107addd3d45f340bcrc32: F4FEA054md5: 3a39b30358c4115951ae9ba705bae7ddsha1: 0089765d9540273b12fd5d3a145800d79d90eb08sha256: 7880c95cb51d106ff88e4fdc53c08d84523f443599b56ca2107addd3d45f340bsha512: d7db80b0a5fac0d5da985234d4844eaaec706ba96098e1fcc0a4ad5348b4949c52fcdcb30edabcd202e06253b5c8a89607b491352fcf33821ffab0c241d43d99ssdeep: 1536:Zn4Mi33LS7enDxBu4mhfzs4i7RC5BnjmV46m2wGz9ku0a:Zfi3b8enD3ehfA4i0EHnwGz9watype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windowstlsh: T1C293BED996052537E3BB483664AB3F26492D2172384AA48BE73310D53CBA1B1FB05F4Fsha3_384: 76d677084b946042fd57758d896235412a16b943f22110a3e01fac490c266b253c3acc27612224f90108ee24145c0209ep_bytes: 558bec81ec1c0100008b450c53485685timestamp: 2010-11-13 13:24:03
Version Info:
0: [No Data]

Trojan.PWS.Onlinegames.KEGA also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Kykymber.lxga
Elastic	malicious (moderate confidence)
ClamAV	Win.Spyware.78845-2
FireEye	Generic.mg.3a39b30358c41159
CAT-QuickHeal	Trojan.OnLineGames.gen
Skyhigh	BehavesLike.Win32.PWSOnlineGames.mm
McAfee	PWS-OnlineGames.ke
Cylance	unsafe
Zillya	Trojan.Kykymber.Win32.1401
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004bcce41 )
Alibaba	TrojanPSW:Win32/Kykymber.05ae7599
K7GW	Password-Stealer ( 0018a90c1 )
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Trojan-PSW.OLGames.ay
VirIT	Trojan.Win32.Zyx.CC
Symantec	Infostealer.Gampass
ESET-NOD32	a variant of Win32/PSW.Kykymber.AA
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-PSW.Win32.Kykymber.kyc
BitDefender	Trojan.PWS.Onlinegames.KEGA
NANO-Antivirus	Trojan.Win32.OnLineGames.bkxdd
MicroWorld-eScan	Trojan.PWS.Onlinegames.KEGA
Avast	Win32:OnLineGames-FUZ [Trj]
Tencent	Trojan.PSW.Win32.MiBao.a
F-Secure	Trojan.TR/PSW.Kykymber.AC
DrWeb	Trojan.PWS.Siggen.14916
VIPRE	Trojan.PWS.Onlinegames.KEGA
TrendMicro	TSPY_KYMBER.SMA
Sophos	Mal/PWS-AL
Ikarus	Trojan-PWS.Win32.Kykymber
Jiangmin	Trojan/Generic.blst
Webroot	W32.InfoStealer.OnlineGames.Gen
Google	Detected
Avira	TR/PSW.Kykymber.AC
Antiy-AVL	Trojan[PSW]/Win32.OnLineGames.pot
Kingsoft	malware.kb.a.1000
Xcitium	Packed.Win32.MUPX.Gen@24tbus
Arcabit	Trojan.PWS.Onlinegames.KEGA
ViRobot	Trojan.Win32.A.PSW-Kykymber.48396
ZoneAlarm	Trojan-PSW.Win32.Kykymber.kyc
GData	Win32.Trojan-Spy.OnlineGames.N
Varist	W32/OnlineGames.FL.gen!Eldorado
AhnLab-V3	Win-Trojan/Onlinegamehack37.Gen
BitDefenderTheta	AI:Packer.E6ACD38D20
ALYac	Trojan.PWS.Onlinegames.KEGA
MAX	malware (ai score=100)
VBA32	BScope.TrojanPSW
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Kykymber.A
TrendMicro-HouseCall	TSPY_KYMBER.SMA
Rising	Stealer.QQPass!1.659F (CLASSIC)
Yandex	Trojan.PWS.Kykymber!394WNEsL4Qw
SentinelOne	Static AI – Malicious PE
MaxSecure	not-a-virus-PSW-OnlineGames.Gen
Fortinet	W32/Onlinegames.XQB!tr
AVG	Win32:OnLineGames-FUZ [Trj]
DeepInstinct	MALICIOUS