PWS:Win32/OnLineGames.AAC

PWS:Win32/OnLineGames.AAC is a generic detection for malware that steals user account information for the game "Perfect World".

Installation

PWS:Win32/OnLineGames.AAC drops the following files:

• <system folder>\10<two characters>.dll
• elementclientgj01.ocx
• new.dll

Payload

Replaces system files
PWS:Win32/OnLineGames.AAC replaces certain system files, such as the following, with copies of itself:

• <system folder>\ddraw.dll
• <system folder>\dsound.dll

The replaced files are also detected as PWS:Win32/OnLineGames.AAC.

Some variants may also replace the file "<system folder>\ksuer.dll", if found, with a copy of itself.

Steals user credentials
PWS:Win32/OnLineGames.AAC loads its dropped DLL file "10<two characters>.dll", which in turn loads its other dropped file "elementclientgj01.ocx". This ActiveX file contains the functionality to steal user credentials for the game "Perfect World". The stolen information is then sent to a remote server via HTTP.

Additional information

One particular variant of PWS:Win32/OnLineGames.AAC only works if the current system date is prior to June 8th. This may be to address an issue with a certain version of the game.

Analysis by Jim Wang