Home / malware

PDF

TrojanDownloader:ASX/Wimad.CI

First posted on 21 March 2019.
Source: Microsoft

Aliases :

There are no other names known for TrojanDownloader:ASX/Wimad.CI.

Explanation :

TrojanDownloader:ASX/Wimad.CI is a detection for malicious Windows media files that encourage users to download and execute arbitrary files on an affected machine. When opened with Windows Media Player, these malicious files open a particular URL in a Web browser. InstallationTrojanDownloader:ASX/Wimad.CI is a malicious Advanced Streaming Format (ASF) file, which when opened by Windows Media Player, urges a user to download and execute an arbitrary file. In the wild, files detected as TrojanDownloader:ASX/Wimad.CI have been observed to be distributed with file extensions such as .MP3, .ASF, .WMA, and .ASX. The file names used have been varied and enticing. Payload Redirects Web trafficAt the time of writing, ASX/Wimad.CI redirects users to the IP address '216.93.188.81', from which it attempts to download and install a possibly unwanted toolbar from 'sharebuddy.ourtoolbar.com'. Microsoft strongly suggest that users avoid downloading and executing any files when prompted by Windows Media Player upon opening streaming format files.  Analysis by Francis Allan Tan Seng

Last update 21 March 2019

 

TOP