Trojan-Downloader.Win32.Small.jm

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads other programs via the Internet and launches them for execution on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 7000 bytes in size.

Payload

Once launched, the Trojan saves its configuration to the following file which it creates in the Windows sytem directory:

%System%\Setup.dfg

The Trojan then downloads a file from the following URL:

http://66.98.***.45/mega/upx.php***

(At the moment of writing, this link was not working.)

The file will then be saved to the Windows system directory:

%System%\tempload.exe

If this file is downloaded successfully, and is an application, then the Trojan will launch it for execution. Otherwise, the Trojan will repeat the attempt to download the file every ten seconds.

The Trojan also opens UDP port 12021 to incoming connections.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following files:

   %System%\Setup.dfg
   %System%\tempload.exe

4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).