Home / malware

PDF

TrojanProxy:Win32/Poindampa.A

First posted on 17 July 2015.
Source: Microsoft

Aliases :

There are no other names known for TrojanProxy:Win32/Poindampa.A.

Explanation :

Threat behavior

Installation
This threat can create files on your PC, including:

• %LOCALAPPDATA% \temp\domain\wdacl.exe
• %APPDATA% \roaming\appdomain.exe

The malware uses code injection to make it harder to detect and remove. It can inject code into running processes.



Payload


Connects to a remote host

We have seen this threat connect to a remote host, including:

• metro.geotrk.net using port 53

Malware can connect to a remote host to do any of the following:

• Check for an Internet connection
• Download and run files (including updates or other malware)
• Report a new infection to its author
• Receive configuration or other data
• Receive instructions from a malicious hacker
• Search for your PC location
• Upload information taken from your PC
• Validate a digital certificate

This malware description was published using automated analysis of file SHA1 6bb889eb77c2d527b37d5b76c646993bc481d185.

Symptoms

The following can indicate that you have this threat on your PC:

• You see a file similar to:
  • c:\users\administrator\appdata\local\microsoft\internet explorer\recovery\high\active\recoverystore.{6b7f8678-535c-11e4-ae41-00155d01ad80}.dat
  • c:\users\administrator\appdata\local\temp\domain\wdacl.exe
  • c:\users\administrator\appdata\roaming\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
  • c:\users\administrator\appdata\roaming\appdomain.exe

• You see the following mutex:
  • !BrowserEmulation!SharedMemory!Mutex
  • c:!users!administrator!appdata!local!microsoft!feeds cache!
  • c:!users!administrator!appdata!local!microsoft!windows!history!history.ie5!
  • c:!users!administrator!appdata!local!microsoft!windows!temporary internet files!content.ie5!
  • c:!users!administrator!appdata!roaming!microsoft!windows!cookies!
  • CDC_VORDME_INSTANCE_MUTEX_20140717
  • ConnHashTable<2188>_HashTable_Mutex
  • CSM Policy Key Mutex
  • IESQMMUTEX_0_208

Last update 17 July 2015

 

TOP