Trojan-Downloader.Win32.Genome.baql

Technical Details

This Trojan downloads files from the Internet without the user's knowledge. It is a Windows application (PE EXE file). It is 32 811 bytes in size. It is written in C++.

MD5: 58468856d51336ec82c2b4af069cee6e

SHA1: 789be76cfa35513c18b7ea1101aab5b06b8ff1d1

Payload

When launched, the Trojan downloads a file from the Internet via the following link:

http://www.*****8pp.info/xxxeeeddd.exe

The downloaded file is saved to the current user's temporary directory under the name:

%Temp%\setup.exe

The downloaded file is then launched for execution.

The Trojan then creates a command interpreter file in its working directory, launches it for execution and ceases running. This file deletes both the original Trojan file and itself.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the following file:

   %Temp%\setup.exe

2. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).