Home / malware Trojan:Win32/CoinMiner.AJ
First posted on 29 October 2014.
Source: MicrosoftAliases :
There are no other names known for Trojan:Win32/CoinMiner.AJ.
Explanation :
Threat behavior
Installation
Trojan:Win32/CoinMiner.AJ creates the following files on your PC:
- c:\documents and settings\administrator\application data\adobe\flash player\cache\idmcache.bat
- c:\documents and settings\administrator\application data\adobe\flash player\cache\idmcache.vbs
- c:\documents and settings\administrator\application data\adobe\flash player\cache\idmgrhlp.exe - detected as Trojan:Win32/CoinMiner.AJ
- c:\documents and settings\administrator\application data\adobe\flash player\cache\libcurl.dll
- c:\documents and settings\administrator\application data\adobe\flash player\cache\pthreadgc2.dll
- c:\documents and settings\administrator\application data\adobe\flash player\cache\zlib1.dll
Payload
Contacts remote host
Trojan:Win32/CoinMiner.AJ might contact a remote host at cdn.cloudservice.su using port 9327. Commonly, malware does this to:This malware description was produced and published using automated analysis of file SHA1 026f7c35fcc6baa7cf3051fde729dec60bb4b500.Symptoms
- Report a new infection to its author
- Receive configuration or other data
- Download and run files, including updates or other malware
- Receive instructions from a remote hacker
- Upload data taken from your PC
System changes
The following could indicate that you have this threat on your PC:
- You have these files:
c:\documents and settings\administrator\application data\adobe\flash player\cache\idmcache.bat
c:\documents and settings\administrator\application data\adobe\flash player\cache\idmcache.vbs
c:\documents and settings\administrator\application data\adobe\flash player\cache\idmgrhlp.exe
c:\documents and settings\administrator\application data\adobe\flash player\cache\libcurl.dll
c:\documents and settings\administrator\application data\adobe\flash player\cache\pthreadgc2.dll
c:\documents and settings\administrator\application data\adobe\flash player\cache\zlib1.dllLast update 29 October 2014