Trojan-Dropper.Win32.Small.ig

Technical Details

This Trojan program will drop another malicious program onto the victim machine.

The main file is a Windows PE EXE file 6KB or larger in size, packed using FSG. The unpacked file is approximately 25KB in size.

Once launched, the Trojan copies itself to the Windows system directory as "winupd.exe ":

%System%\winupd.exe

It then registers this file in the system directory, ensuring that the file will be launched each time Windows is rebooted on the victim machine:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"winupd" = "%System%\winupd.exe" 

The Trojan will also change the configuration of Internet Explorer, and add its own links to the Favorites menu.

The original file will then be deleted.

There are other variants of this Trojan which contain other files. When the Trojan is launched these files will be installed on the victim machine without the user's knowledge or consent. They will be installed in the Program files directory, and then launched for execution.