Trojan-Downloader.Win32.Small.ksm

Technical Details
Payload
Removal instructions

Technical Details

This Trojan is designed to install and launch other programs on the victim machine without the knowledge or consent of the user. It is a Windows application (PE EXE file). It is 14 848 bytes in size. It is written in C++.

Payload

Once launched, the Trojan decrypts its body and downloads files from the following URLS:

http://188.***.161/varag_sdfgkwlkgadfshn.exe
http://85.***.111/bat.exe

At the time of writing, these links were inactive. The Trojan saves the downloaded files under the following names respectively:

%WinDir%\Temp\_ex-68.exe
%WinDir%\Temp\_ex-08.exe

It then launches the downloaded files for execution and ceases running.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following files:

   %WinDir%\Temp\_ex-68.exe
   %WinDir%\Temp\_ex-08.exe
   

3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: E58B6BDF6531B471EEC9EFDCFA70E8FF
SHA1: 0A38BF1115039370803B3FDC80D17BC0E25CA47D