Trojan.Win32.Small.cjr

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads files from the Internet and launches them on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 4,096 bytes in size. It is written in C++.

Payload

After launch, the Trojan downloads files from the Internet at the following links:

http://69.***.241/fxasd/xl2.php
http://76.***.4/data/upd13.dat

The downloaded files are saved in the current user’s temporary folder “%Temp%” using random names. Once successfully downloaded, the files are launched for execution. At the time of writing, these files could not be downloaded.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the victim machine).
2. Delete the files downloaded by the Trojan in the “%Temp%” folder.
3. Empty the Temporary Internet Files folder, which may contain infected files (How to delete infected files from Temporary Internet Files folder?).
4. Update your antivirus databases and perform a full scan of the computer (Download a trial version of Kaspersky Anti-Virus).

Summary

• Implements network activity

Technical details

File size of 4096 bytes.

Malicious activity

Connects to to the following Internet addresses:

• ***.174.93.91:20480