Home / malware

PDF

TrojanClicker:Win32/Losicoa.A

First posted on 18 August 2019.
Source: Microsoft

Aliases :

There are no other names known for TrojanClicker:Win32/Losicoa.A.

Explanation :

Installation This threat can create files on your PC, including:
%LOCALAPPDATA%microsoftinternet explorer
ecoveryactive{4551a5d8-2e2c-11e4-8379-00db7fa21011}.dat %LOCALAPPDATA%microsoftinternet explorer
ecoveryactive
ecoverystore.{3885c6cc-2e2c-11e4-8379-00db7fa21011}.dat

It can make various registry changes during its installation, including:

In subkey: HKLMsoftwareclasses ypelib{1ea4dbf0-3c3b-11cf-810c-00aa00389b71}1.1win32
Sets value: "(default)"
With data: "oleacc.dll"

Payload

Clicks on advertisements

This trojan can use your PC to click on online advertisements without your permission or knowledge.

A malicious hacker can earn money out of these clicks by making a website or application appear more popular than it is.

Connects to a remote host

We have seen this threat connect to a remote host, including: doomp3.net using port 80 Malware can connect to a remote host to do any of the following:Check for an Internet connectionDownload and run files (including updates or other malware)Report a new infection to its authorReceive configuration or other dataReceive instructions from a malicious hackerSearch for your PC locationUpload information taken from your PCValidate a digital certificate Additional information

Creates a mutex

This threat can create one or more mutexes on your PC. For example:

ConnHashTable<2248>_HashTable_Mutex Local!BrowserEmulation!SharedMemory!Mutex LocalFeed Eventing Shared Memory Mutex S-1-5-21-1844237615-2111687655-839522115-500 LocalRSS Eventing Connection Database Mutex 000008c8

It might use this mutex as an infection marker to prevent more than one copy of the threat running on your PC.

This malware description was published using automated analysis of file SHA1 32a8eb9291107cf145b88d4e3e9aa0b355caef89.

Last update 18 August 2019

 

TOP