Trojan-Downloader.Win32.Agent.ecwi

Technical Details

This Trojan downloads another program to the computer without the user's knowledge. It is a Windows application (PE EXE file). It is 5120 bytes in size. It is written in C++.

Payload

Once launched, the Trojan downloads files from the following URL addresses:

http://89.***.229/dm/files/aukhrfbv.exe
http://89.***.229/dm/files/hftywmn.exe
http://89.***.229/dm/files/knwtxtk.exe
http://89.***.229/dm/files/sdknfhl.exe

At the time of writing, these links were inactive.

It saves the downloaded files in the current user's temporary directory under the names:

%Temp%\BN<rnd>.tmp
%Temp%\BN<rnd>.tmp
%Temp%\BN<rnd>.tmp
%Temp%\BN<rnd>.tmp

where is a random set of numbers and letters.

The Trojan then launches the downloaded files, and then deletes them.

The Trojan then deletes its original body and ceases running.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following files:

   %Temp%\BN<rnd>.tmp
   %Temp%\BN<rnd>.tmp
   %Temp%\BN<rnd>.tmp
   %Temp%\BN<rnd>.tmp
   

   where <rnd> is a random set of numbers and letters.