Trojan-Downloader.Win32.Small.bpan

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads other malware via the Internet and launches it for execution without the user's knowledge or consent. It is a Windows application (PE EXE file). It is 2560 bytes in size. It is written in C++.

Payload

Once launched, the Trojan establishes a connection with the following IP address:

69.***.192.250

It receives encrypted data. The Trojan then decrypts this data and saves the files in the current user's temporary directory under the names like:

%Temp%\_<rnd>.tmp

where <rnd> is a random set of numbers and letters of the Latin alphabet.

The Trojan then launches these files for execution and ceases running.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following files:

   %Temp%\_<rnd>.tmp

3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: A51B21251FBC40F0D678F09C7F1E26C5

SHA1: F685C9C3ECE3E86FAC085ED28DC291E6B15A93E1