Trojan-Downloader.Win32.Small.ckn

Technical Details

This Trojan is designed to download other files via the Internet without the knowledge or consent of the user.

The Trojan itself is a Windows PE EXE file, 3072 bytes in size, packed using FSG. The unpacked file is approximately 28KB in size.

Payload

Once launched, the Trojan checks to see if %System%\qvxgamet1.exe is present. If not, the Trojan will then delete a file called %Temp%\qvxt1.game (if there is such a file on the victim machine and downloads data from http://**ko.biz/dl.php in its place.

The Trojan then deletes the following files (if they are present on the victim machine):

%Temp%\qvxt2.game
%Temp%\qvxt3.game
%Temp%\qvxt4.game

It then downloads data from the following URLs in place of these files:

http://**ko.biz/soft/1.exe/
http://**ko.biz/soft/2.exe/
http://**ko.biz/soft/3.exe/

If the download is successful, the Trojan copies the downloaded files to the Windows system directory under the following names:

%System%\qvxgamet2.exe
%System%\qvxgamet3.exe
%System%\qvxgamet4.exe

If these files already exist, the data in them will be overwritten.

If for some reason the download is not successful, a repeat attempt to download will be made after 5 minutes.

Once the files have been downloaded, they will be launched for execution. The execution of the Trojan program will be terminated.

At the time of writing, the links contained in this description were not functioning.

Removal instructions

1. Delete the original Trojan file (its location will depend on how it originally penetrated the victim machine).
2. Delete the files downloaded by the Trojan:

   %System%\qvxgamet2.exe
   %System%\qvxgamet3.exe
   %System%\qvxgamet4.exe
   %Temp%\qvxt1.game
   %Temp%\qvxt2.game
   %Temp%\qvxt3.game
   %Temp%\qvxt4.game

3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).