Trojan-Downloader.Win32.Small.cnz

Technical Details

This Trojan downloads other files via the Internet without the knowledge or consent of the user.

The Trojan itself is a Windows PE EXE file, 2896 bytes in size, packed using FSG. The unpacked file is approximately 20KB in size.

Payload

When launched, if the file %System%\maxd64.exe is present on the victim machine, the Trojan will launch it for execution. If this file is not present, the Trojan will download a program from http://85.255.***.162/gdn***433.exe and save it to %Temp%\maxdd.game. The Trojan then copies the program to %System%\maxd64.exe and launches it for execution.

At the time of writing the link given above was non functional.

Removal instructions

1. Delete the original Trojan file (its location depends on how the Trojan originally penetrated the victim machine).
2. Delete the files downloaded by the Trojan:

   %System%\maxd64.exe
   %Temp%\maxdd.game

3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).