Trojan-Downloader.Win32.Small.arf

Technical Details

This Trojan program is a Windows PE EXE file. The file is between 2779 bytes and 5000 bytes in size, and may be packed with MEW or PRLITE. The unpacked file is 25KB or larger in size.

The Trojan is programmed to download files from the Internet and launch them on the victim machine. Files are downloaded from the servers listed below:

http://www.sex***ns.com/images
http://www.za***bank.net/ftp 
http://www.za***bank.net/arbey

These files will then be copied to the C: root directory under a range of names, and launched for execution.

The files which are downloaded may have the following names:

C:\boot.old
C:\win32.exe
C:\win33.exe