Trojan-Downloader.Win32.Small.bxc

Technical Details

This Trojan downloads files via the Internet without the user’s knowledge or consent. It is a Windows PE EXE file 4096 bytes in size.

Payload

Once launched, the Trojan attempts to terminate processes if the names contain the following strings:

Every second, the Trojan will check the IP address of the victim machine; this will continue until the Trojan establishes that the IP address is not 127.0.0.1

The Trojan then downloads several files from the Internet and launches them for execution:

• A file from http://core.****he-evolution.com/x.exe which will be saved to the Windows root directory as “winl.exe”:
  %Windir%\winl.exe
  Kaspersky Anti-Virus will detect this file as Backdoor.Win32.Agent.vq
• A file from http://core.****he-evolution.com/r4.exe which will be saved to the Windows root directory as “sstray.exe”.
  %Windir%\sstray.exe
  At the moment of writing, these links were not working.

The remote malicious user may place different malicious programs on the links.

Removal instructions

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the files downloaded by the Trojan:
   %Windir%\sstray.exe
   %Windir%\winl.exe
3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus)