The file MDAMAND.EXE is identified as a virus dropper.
The dropper MDAMAND.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file MDAMAND.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the MDAMAND.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the MDAMAND.EXE process and delete the file MDAMAND.EXE.
Malware Analysis of MDAMAND.EXE
Full path on a computer: %SysDir%\mdamand.exe
Detected by UnHackMe:
MDAMAND.EXE
Default location: %SysDir%\mdamand.exe
Removal Results: Success
Number of reboot: 1
MDAMAND.EXE is known as:
Trojan.PSW.VB.dgr, Trojan.PSW.VB.dgr, Trojan.VB2.bbsgiy, Trojan-PSW.VB.dgr, Trojan.PSW.VB.chd, Trojan.A.PSW-VB.126976.G, Trojan.VB, a variant of Win32.TrojanDownloader.VB.PXY, Trojan-Spy, W32.VB.DGR.tr.pws
MDAMAND.EXE hash:
- MD5: 675d4aedfc67b3b554f1da20c6e058a7
The file tries to connect to the dangerous web site.
How to quickly detect MDAMAND.EXE presence?
![]( "Registry")
Registry:
![]( "Files")
Files:
Registry:- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MainPro: “%SysDir%\adropen.exe”
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\OpenApi: “%SysDir%\adropen.exe”
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PlaySys: “%SysDir%\ddsplay.exe”
Files:- %Temp%\~DF33AC.tmp
- %Temp%\~DF37CD.tmp
- %Temp%\~DF59D8.tmp
- %Temp%\~DF59DE.tmp
- %Temp%\~DF59E3.tmp
- %Temp%\~DFE3E0.tmp
- %SysDir%\adropen.exe
- %SysDir%\ddsplay.exe
- %SysDir%\mdamand.exe