Categories: Trojan

TrojanDownloader:Win32/Leodon.D removal guide

The TrojanDownloader:Win32/Leodon.D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Leodon.D virus can do?

A file was accessed within the Public folder.
Uses Windows utilities for basic functionality
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
CAPE detected the shellcode patterns malware family
Attempts to modify proxy settings
Touches a file containing cookies, possibly for information gathering
Uses suspicious command line tools or Windows utilities
Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDownloader:Win32/Leodon.D?


File Info:
name: 33D326F7A79494B5CA3E.mlwpath: /opt/CAPEv2/storage/binaries/37548aea431722f23b2af50c6aad316008dc26cc23ad8912f0879daea00790c9crc32: C7840C58md5: 33d326f7a79494b5ca3e39bed9fb8bd5sha1: e3bced71094926669f1ad0c3ba83d7f2c3f61ba1sha256: 37548aea431722f23b2af50c6aad316008dc26cc23ad8912f0879daea00790c9sha512: b68814d15ff4c26e3d06327a4b3a527b109ce665a759be2ab872216a83864a35fa1276444202e1359e1a966d43148b872440ddf730872ea2b21a4043d957d71essdeep: 768:oCyiql0mQoxYlFanSl+Ym+g9iFxEG1tx37S0wPtyoNIUCjejt1P8FFbK4Ntc:Iiql0mQoxpnDYzDWEth+PtyVUCjeEOtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D283D0AEFAE089B3C136DDBD8E24C255DB377A200E2D0645F99E1DDCDE673A1181C206sha3_384: 570c00db30f474847c4b7af111e0cc5958b077c7b11712d9be9370e9491662c816f120b15570d0266222e4ad3635deadep_bytes: 558bec83c4f053b8dc484000e8b3f1fftimestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

TrojanDownloader:Win32/Leodon.D also known as:

Bkav	W32.AIDetectMalware
Lionic	Worm.Win32.Viking.l3Va
MicroWorld-eScan	Gen:Variant.Doina.20805
FireEye	Generic.mg.33d326f7a79494b5
Skyhigh	BehavesLike.Win32.Sytro.lm
McAfee	PolyPatch-UPX
Malwarebytes	Malware.Heuristic.2047
Zillya	Trojan.Delf.Win32.81294
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004bcce41 )
Alibaba	TrojanDownloader:Win32/Cosmu.8728a641
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.7a7949
Baidu	Win32.Trojan.Delf.it
VirIT	Trojan.Win32.Delf.QIP
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	Win32/Delf.PGB
APEX	Malicious
TrendMicro-HouseCall	Mal_Otorun9
ClamAV	Win.Trojan.Agent-899155
Kaspersky	Trojan.Win32.Cosmu.xet
BitDefender	Gen:Variant.Doina.20805
NANO-Antivirus	Trojan.Win32.Nilage.croxoi
Avast	Win32:Adware-gen [Adw]
Tencent	Malware.Win32.Gencirc.13b03a0e
Sophos	W32/Autorun-BGT
F-Secure	Trojan.TR/Delf.V.1
DrWeb	Trojan.MulDrop1.16843
VIPRE	Gen:Variant.Doina.20805
TrendMicro	Mal_Otorun9
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Doina.20805 (B)
Ikarus	Worm.Win32.AutoRun
Jiangmin	Trojan/Cosmu.dkj
Google	Detected
Avira	TR/Delf.V.1
Varist	W32/Autorun.DVQD-1997
Antiy-AVL	Worm/Win32.AutoRun
Kingsoft	Win32.HeurC.KVM003.a
Microsoft	TrojanDownloader:Win32/Leodon.D
Xcitium	Packed.Win32.MUPX.Gen@24tbus
Arcabit	Trojan.Doina.D5145
ZoneAlarm	Trojan.Win32.Cosmu.xet
GData	Gen:Variant.Doina.20805
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Cosmu.C99609
VBA32	Trojan-Dropper.Delf.Bps
ALYac	Gen:Variant.Doina.20805
MAX	malware (ai score=99)
Cylance	unsafe
Panda	Trj/CI.A
Rising	Downloader.Leodon!8.EA2 (TFE:4:Uc2UGAQ0zfS)
Yandex	Trojan.GenAsa!athc83fE8WU
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1751547.susgen
Fortinet	W32/Cosmu.XET!tr
BitDefenderTheta	AI:Packer.1701B46A20
AVG	Win32:Adware-gen [Adw]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Worm:Win/Delf.PGB