Home / malware TrojanDownloader:MSIL/Downcoin.B
First posted on 19 February 2015.
Source: MicrosoftAliases :
There are no other names known for TrojanDownloader:MSIL/Downcoin.B.
Explanation :
Threat behavior
Installation
This threat can create files on your PC, including:
- %APPDATA%\winminer.exe
- %APPDATA%\winsrv.exe
It modifies the registry so that it runs each time you start your PC. For example:
In subkey: HKCU\software\microsoft\windows\currentversion\run
Sets value: "winsrv.exe"
With data: "%APPDATA%\winsrv.exe"
Payload
Downloads malware or unwanted software
This threat can download other malware and unwanted software onto your PC.
Connects to a remote host
We have seen this threat connect to a remote host, including:Malware can connect to a remote host to do any of the following:
- filehostonline.com using port 80
- Check for an Internet connection
- Download and run files (including updates or other malware)
We have seen this threat access online content, including:
This malware description was published using automated analysis of file SHA1 97f5b3534c3a88d87f1ede3dd730ebb9b1185d17.Symptoms
- bitcoin-miner.exe
The following can indicate that you have this threat on your PC:
- You see these files:
- %APPDATA%\winminer.exe
- %APPDATA%\winsrv.exe
- You see registry modifications such as:
- In subkey: HKCU\software\microsoft\windows\currentversion\run
Sets value: "winsrv.exe"
With data: "%APPDATA%\winsrv.exe"
Last update 19 February 2015