Trojan-Dropper.Win32.Agent.csxg

Technical Details
Payload
Removal instructions

Technical Details

This Trojan installs other programs on the computer without the user's knowledge. It is a Windows application (PE EXE file). It is 40 960 bytes in size. It is packed using ASPack. The unpacked file is approximately 242 KB in size. It is written in C++.

Payload

Once launched, the Trojan carries out the following actions:

• It extracts from itself a file, which is then saved in the system as

  %USERPROFILE%\Microsoft\smx4pnp.dll

  (4608 bytes; detected by Kaspersky Anti-Virus as "Trojan-Downloader.Win32.Small.kph")
• It creates the following system registry key:

  [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
  "smx4pnp" = "rundll32.exe "%USERPROFILE%\Microsoft\smx4pnp.dll", 
  Launch"
  

  Thereby, each time the system is rebooted, the "Launch" function will be called from the previously extracted library.
• It launches the system utility "rundll32.exe" with the settings:

  "%USERPROFILE%\Microsoft\smx4pnp.dll", Launch

• It terminates the process:

  %System%\calc.exe

After this, the Trojan ceases running, at the same time deleting its original file. The extracted library performs the functionality of a downloader. From the server:

mo***lo.in

a file named "s.txt" is requested; this file contains links for downloading files. Then, in a cycle, files are downloaded from the links obtained and launched for execution. The downloaded files are saved in the directory

%Temporary Internet Files%

At the time of writing, these files could not be downloaded.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Use Task Manager to terminate the process "rundll32.exe".
2. Delete the following file:

   %USERPROFILE%\Microsoft\smx4pnp.dll

3. Delete the following system registry key (see What is a system registry and how do I use it?):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "smx4pnp" = "rundll32.exe "%USERPROFILE%\Microsoft\
   smx4pnp.dll", Launch"
   

4. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
5. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

Summary

• Trojan. Performs actions that are typical of malicious programs

Technical details

File size of 235520 bytes.

Installation

Creates the following files on an infected computer:

• Current user directory (usually, C:\Documents and Settings\) %UserDir%\Microsoft\smax1f72c.tmp (­Kaspersky Anti-Virus detects as­ Trojan-Downloader.Win32.Small.kph)
• Current user directory (usually, C:\Documents and Settings\) %UserDir%\Microsoft\smx4pnp.dll (­Kaspersky Anti-Virus detects as­ Trojan-Downloader.Win32.Small.kph)

Malicious activity

Injects its code into the following processes:

• calc.exe

Uses the masks shown below to search for files on the victim machine:

• *.*

Other activities

Runs the following files (commands):

• Windows system directory (usually, C:\Windows\System32) %System%\calc.exe

Modifies the system registry keys:

[ System registry hive HKEY_CURRENT_USERHKCU\Software\Microsoft\Windows\CurrentVersion\Run ] "smx4pnp" = "rundll32.exe " Current user directory (usually, C:\Documents and Settings\) %UserDir%\Microsoft\smx4pnp.dll"

Description:
­Used to automatically run files when the Windows OS boots­

Deletes the following files on an infected computer:

• Current user directory (usually, C:\Documents and Settings\) %UserDir%\Microsoft\smx4pnp.dll