Home / malware

PDF

TrojanClicker:MSIL/Balamid.A

First posted on 09 April 2019.
Source: Microsoft

Aliases :

TrojanClicker:MSIL/Balamid.A is also known as Trojan.Win32.Badur.hfdo, TR/ATRAPS.Gen, Gen:Variant.Zusy.81012.

Explanation :

Installation

This threat is downloaded by TrojanDownloader:MSIL/Balamid.A to %ProgramData%system.exe.

Payload

TrojanClicker:MSIL/Balamid.A will connect to a number of website without your knowledge. It does this to automatically click on advertisements and make them appear more popular than they are.

We've seen this threat connect to the following clean websites:

www.facebook.com www.haberedikkat.com www.onlinefilmizlevk.com www.saykar.net www.unimetre.com

Analysis by Zhitao Zhou

Last update 09 April 2019

 

TOP