Trojan-Downloader.Win32.Small.ddp

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads other malicious programs. It is a Windows PE EXE file. It is written in Microsoft Visual C++. It is not packed in any way. The size of infected files may vary from 20KB to 27KB.

Payload

Once launched, the Trojan extracts a file from itself, and saves it to the C:\Windows directory as "inetloader.dll".

This file will then be registered in the system using regsrv32.exe. It will download the following file from the Internet: http://soft.*****incash.com/loader/run.xml. This file contains links to other files, and the paths used to save them. The Trojan then downloads files from the links given.

At the moment of writing, the “run.xml” file contained links to the following files:

• http://soft.*****incash.com/contextual/ticads.exe — this file will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Small.ddp;
• http://soft.*****incash.com/popups/tpopup.exe — this file will be detected by Kaspersky Anti-Virus as not-a-virus:AdWare.Win32.Trustin.a;
• http://soft.*****incash.com/se/tse.exe — this file will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Small.ddp;
• http://soft.*****incash.com/tcleaner/tctool.exe — this file will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.WarSpy.d;
• http://soft.*****incash.com/toolbar/trustinbar.exe — this file will be detected by Kaspersky Anti-Virus as not-a-virus:AdWare.Win32.Azesearch.h;
• http://soft.*****incash.com/url/url.exe — this file will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Small.ddp.

The downloaded files are saved to the Windows root directory:

%windir%\ticads.exe
%windir%\tpopup.exe
%windir%\tse.exe
%windir%\tctool.exe
%windir%\trusnibar.exe
%windir%\url.exe

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the following file:

   C:\Windows\inetloader.dll

3. Delete the following files:

   %windir%\ticads.exe
   %windir%\tpopup.exe
   %windir%\tse.exe
   %windir%\tctool.exe
   %windir%\trusnibar.exe
   %windir%\url.exe

4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).