TrojanDownloader:Win32/Cordmix.A is a trojan that silently downloads and installs other programs without consent. This could include the installation of additional malware or malware components to an affected computer.
When executed, TrojanDownloader:Win32/Cordmix.A
copies itself to the following locations:
- %programfiles%\common files\datacardservice\dcservice.exe
- c:\documents and settings\administrator\application data\datacardservice\dcservice.exe
The malware creates the following files on an affected computer:
Contacts remote host
TrojanDownloader:Win32/Cordmix.A may contact a remote host at kullywolf.gicp.net using port 8088. Commonly, malware may contact a remote host for the following purposes:
- To report a new infection to its author
- To receive configuration or other data
- To download and execute arbitrary files (including updates or additional malware)
- To receive instruction from a remote attacker
- To upload data taken from the affected computer
This malware description was produced and published using our automated analysis system's examination of file SHA1 bf0be7b33bd0e1908f39c125947cecb6cd78c1fe.