Trojan-Downloader.Win32.Small.eqn

Technical Details

This Trojan downloads other programs via the Internet and launches them on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. The file is 10,326 bytes in size. It is packed using UPX. The unpacked file is approximately 54KB in size.

Payload

The Trojan downloads a file from the following link:

The file will be saved to the Windows root directory:

The file is then launched for execution.

At the moment of writing, the file placed on this link was 39 424 bytes in size. Kaspersky Anti-Virus detects this file as Trojan-Downloader.Win32.Agent.bls.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following file:
   %WinDir%\retadpu%rnd%.exe
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Summary

• Trojan-Downloader. Downloads other malicious programs to a computer without the user's knowledge

Technical details

The main file is a Windows application (PE EXE file). File size of 10326 bytes. The file was packed using a special compression utility. Compression can be used for a number of reasons, including for legitimate programs. However, virus writers frequently use it to bypass antivirus protection and to make it difficult for virus analysts to analyze compressed programs Packed UPX.

Malicious activity

Downloads files from specified URLs.

Downloaded files are launched for execution