Home / malware

PDF

TrojanDownloader:Win32/Telovsed.A

First posted on 07 September 2010.
Source: SecurityHome

Aliases :

TrojanDownloader:Win32/Telovsed.A is also known as TROJ_GENOME.CZ (Trend Micro), Trojan-Downloader.Win32.Genome.azfl (Kaspersky).

Explanation :

TrojanDownloader:Win32/Telovsed.A is a trojan that silently downloads and installs other programs without consent. This could include the installation of additional malware or malware components to an affected computer.
Top

TrojanDownloader:Win32/Telovsed.A is a trojan that silently downloads and installs other programs without consent. This could include the installation of additional malware or malware components to an affected computer. Installation When executed, TrojanDownloader:Win32/Telovsed.A copies itself to <system folder>\debug1.exe.
Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.
The malware creates the following files on an affected computer:

c:\cmd.txt

Payload Contacts remote host TrojanDownloader:Win32/Telovsed.A may contact a remote host at 9394dy.3322.org using port 80. Commonly, malware may contact a remote host for the following purposes:

• To report a new infection to its author
• To receive configuration or other data
• To download and execute arbitrary files (including updates or additional malware)
• To receive instruction from a remote attacker
• To upload data taken from the affected computer

This malware description was produced and published using our automated analysis system's examination of file SHA1 a1d7947ebac68eb5098bb3a1a078a411fc960dc1.

Last update 07 September 2010

 

TOP