Trojan-Dropper.Win32.Small.o

Technical Details

Trojan-Dropper.Win32.Small.o is the name for a family of Trojan programs which install other malicious programs on the victim machine without the knowledge or consent of the user. The programs are Windows PE EXE files. The file size may vary significantly.

Further details of one program in this family are as follows: the file is called result.exe, with the following MD5: 67abb14646d81701af7d64721962dab8. It is a Windows PE EXE file. The file is 402,976 bytes in size.

Payload

Once launched, the Trojan will extract four files with temporary names from itself to the Windows temporary directory:

• %Temp%\<temporary_name>.exe (17 410 bytes in size, will be detected by Kaspersky Anti-Virus as Trojan.Win32.OptixKill.20.a);
• %Temp%\<temporary_name>.jpg (9 609 bytes in size. This file is not malicious.);
• %Temp%\<temporary_name>.exe (369 990 bytes in size. This file will be detected by Kaspersky Anti-Virus as Backdoor.Win32.SubSeven.21.b);
• %Temp%\<temporary_name>.vbs (741 bytes in size. This file will be detected by Kaspersky Anti-Virus as Email-Worm.VBS.Spam.BRIEF).

The files are then launched for execution

Removal instructions

1. Use Task Manager to terminate the original Trojan process and files created by the Trojan.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following files:

   %Temp%\<temporary_name;.exe
   %Temp%\<temporary_name;.jpg
   %Temp%\<temporary_name;.exe
   %Temp%\<temporary_name;.vbs

4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).