Trojan-Downloader.Win32.Small.laa

Technical Details

This program is a Trojan. It is a Windows application (PE EXE file). It is 11 017 bytes in size. It is written in C++.

MD5: 916aafb828c3dc048920befb6b0091ce

SHA1: 4644bece2b7fa3d33a3a81c9c34979839793c56d

Payload

When launching, the Trojan extracts the following file from its body and saves it to the Windows system directory under the name:

%System%\mn.dll

This file is 5120 bytes in size. It is detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Genome.cfbv.

Then the Trojan injects the library created into the address space of the process "explorer.exe" and launches.

The Trojan then ceases running.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the following files:

   %System%\mn.dll

2. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

Summary

• Trojan. Performs actions that are typical of malicious programs

Technical details

File size of 25984 bytes.

Installation

Creates the following files on an infected computer:

• Windows system directory (usually, C:\Windows\System32) %System%\mn.dll (­Kaspersky Anti-Virus detects as­ Trojan-Downloader.Win32.Genome.cdcj)
• Windows system directory (usually, C:\Windows\System32) %System%\gewsfegtws.bat

Malicious activity

Injects its code into the following processes:

• explorer.exe

Uses the masks shown below to search for files on the victim machine:

• ping.*

Other activities

Runs the following files (commands):

• Windows system directory (usually, C:\Windows\System32) %System%\cmd.exe /c Windows system directory (usually, C:\Windows\System32) %System%\gewsfegtws.bat
• Windows system directory (usually, C:\Windows\System32) %System%\ping.exe ping 127.1 /n 2

Searches for the following windows:

Class:

Shell_TrayWnd

Deletes the following files on an infected computer:

• <­path to source program­><­file of source program ­>
• Windows system directory (usually, C:\Windows\System32) %System%\GEWSFE~1.BAT