Trojan-Downloader.Win32.Agent.elej

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Windows application (PE EXE file). It is 27 648 bytes in size. It is packed using PE_Patch or UPX. The unpacked file is approximately 99 KB in size. It is written in C++.

Payload

Once launched, the Trojan establishes a connection with this server:

85.***.131

Thereafter, the malicious user can use the infected computer for sending spam. The Trojan obtains all of the information necessary for this from the malicious user's server. It can also download other malicious programs from this server. The downloaded files are saved in the current user's temporary files directory "%Temp%" using random names. Once downloaded, the files are launched for execution.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Use Task Manager to terminate the Trojan process.
2. Delete the files downloaded by the Trojan in the "%Temp%" directory.
3. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
4. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

Summary

• Implements network activity

Technical details

File size of 27648 bytes.

Malicious activity

Connects to to the following Internet addresses:

• ***.17.188.131:47539
• ***.17.188.131:47873
• ***.200.241.188:20480