Trojan-Downloader.Win32.Small.kph

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Windows dynamic library (PE DLL file). It is 4608 bytes in size. It is written in C++.

Payload

The Trojan library performs the functionality of a downloader. The library exports the function "Launch", and when it calls this function, it establishes a connection with the following server:

m***lo.in

Then, a file named "s.txt" is requested from the server; this file contains links for downloading files. After this, files are downloaded from the links obtained and launched for execution. The downloaded files are saved in the directory

%Temporary Internet Files%

At the time of writing, these files could not be downloaded.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Terminate the process containing the Trojan library in its address space.
2. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
3. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
4. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

Summary

• Trojan-GameThief. Steals confidential information from games

• Trojan. Performs actions that are typical of malicious programs

Technical details

File size of 5024 bytes.

Installation

Creates the following files on an infected computer:

• Windows system directory (usually, C:\Windows\System32) %System%\xcvaver0.dll (­Kaspersky Anti-Virus detects as­ Trojan-GameThief.Win32.OnLineGames.bnnm)

Malicious activity

Steals A malicious program designed to steal accounts (login and password) and other information used to access multi-player games. The stolen information is sent to a cybercriminal via email, ftp, the web or other methods. The cybercriminal uses the stolen data to steal the virtual property of a player, or to commit other types of fraud.
Read more details here: http://www.viruslist.com/en/analysis?pubid=204791963confidential user information from the following games:

• Maple Story
• PlayOnline Viewer

Injects its code into the following processes:

• explorer.exe

Other activities

Modifies the system registry keys:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Classes\CLSID\{C3D16072-B843-2E1B-450B-50EADDC8EB63} ] "VcmnExeModuleName" = " Current user directory (usually, C:\Documents and Settings\) %UserDir%\Local Settings\Temporary Internet Files\Content.IE5\HRHF4UTL\ma[1].exe"

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Classes\CLSID\{C3D16072-B843-2E1B-450B-50EADDC8EB63} ] "VcmnDllModuleName" = " Windows system directory (usually, C:\Windows\System32) %System%\xcvaver0.dll"

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Classes\CLSID\{C3D16072-B843-2E1B-450B-50EADDC8EB63} ] "VcmnSobjEventName" = "BNMJJHYUIOPTREMN_0"

Deletes the following files on an infected computer:

• Windows system directory (usually, C:\Windows\System32) %System%\xcvaver0.dll
• Current user directory (usually, C:\Documents and Settings\) %UserDir%\Local Settings\Temporary Internet Files\Content.IE5\HRHF4UTL\ma[1].exe