Threat Database Trojans Trojan.Downloader.Gen.TI

Trojan.Downloader.Gen.TI

By CagedTech in Trojans
Published:

Threat Scorecard

Threat Level: 80 % (High)
First Seen: June 9, 2026
Last Seen: October 21, 2026
OS(es) Affected: Windows

Trojan.Downloader.Gen.TI is a Windows-based Trojan downloader classified as a high-risk threat, with a danger level of 8 out of 10. Its primary purpose is not to damage files directly, but to secretly bring additional malware onto an infected computer. Trojan downloaders like this one act as a delivery mechanism, often working quietly in the background while more damaging payloads are fetched and installed without the user's knowledge.

What Trojan.Downloader.Gen.TI Does

Once active on a system, Trojan.Downloader.Gen.TI runs silently in the background and performs malicious functions designed to avoid detection. It is capable of allowing attackers to gain complete control over an infected system. Like other members of this threat category, it may be disguised to look like a legitimate file; in some observed cases, this type of threat has been found mimicking or attaching itself to file names and version details associated with well-known software products, making it harder for an average user to notice anything unusual. The core function of a downloader Trojan is to quietly communicate with remote servers and retrieve additional malicious components, which can include spyware, ransomware, backdoors, or other Trojans, expanding the scope of damage well beyond the initial infection.

How It Usually Gets Onto Computers

Trojan.Downloader.Gen.TI typically stealth-installs itself by exploiting system vulnerabilities and security flaws. Common infection paths include software downloads from malicious or compromised websites and email attachments sent from untrusted sources. These attachments are not always obviously dangerous — they can appear as executable files (.exe, .pif) or be disguised as seemingly harmless media or image files (such as .avi or .jpg), tricking users into opening them. Because the Trojan is built to install without any visible prompts or warnings, many victims have no idea the infection has taken place until further symptoms appear.

Risks for the User

The risks associated with this Trojan are significant. Because it can hand over control of the system to remote attackers, victims may face unauthorized monitoring, data theft, installation of further malware, or misuse of the computer for other malicious purposes. Since the file carrying this threat can appear unsigned or altered to resemble trusted software, users may unknowingly keep it running for extended periods, giving attackers continued access.

Signs of Infection

Trojan downloaders are designed to operate quietly, so obvious symptoms are often minimal. However, users should watch for warning signs typical of this malware category, including:

  • Unexpected slowdowns or unusual background network activity
  • New, unfamiliar programs or files appearing without explanation
  • Security tools being disabled or failing to update
  • Unusual system behavior, crashes, or unexpected pop-ups

How to Stay Protected

To reduce the risk of infection, users should avoid downloading software from unverified or suspicious websites and never open email attachments from unknown or untrusted senders, even if the file type seems harmless. Keeping the Windows operating system and installed applications fully updated helps close the security vulnerabilities that threats like this often exploit. Running reputable, up-to-date security software and performing regular system scans is also an important part of a broader defense strategy against downloader Trojans and the secondary threats they introduce.

Analysis Report

General information

Family Name: Trojan.Downloader.Gen.TI
Signature status: No Signature

Known Samples

MD5: fb0488276804a442dbd3b9ef176f7291
SHA1: 5044860cea6ef465438fff70093373f4adf8655a
SHA256: 683FC3FC01BC4516A5306FCC17B33023643F8CF4D87397A6158D79B9EC621E42
File Size: 222.21 KB, 222208 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show 1 more
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Company Name Autodesk
File Description AutoCAD Dwg common shell extension handler
File Version 24.1.51.0.0
Internal Name Dwg shell extension handler
Legal Copyright Copyright 2021 Autodesk, Inc. All rights reserved.
Original Filename AcShellExtension.dll
Product Name AutoCAD
Product Version 24.1.51.0.0

File Traits

  • 2+ executable sections
  • dll
  • x64

Block Information

Total Blocks: 782
Potentially Malicious Blocks: 4
Whitelisted Blocks: 712
Unknown Blocks: 66

Visual Map

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Rugmi.XD

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtProtectVirtualMemory
Show 20 more
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile