Small.QP

Classification

Malware

Trojan-Dropper

-

Small.QP

Summary

Small.QP copies itself to the Windows folder and attempts to download and install other malware to the system.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Upon execution, this malware creates the mutex _Win_Loader_ to ensure that only one instance of itself is running in memory.Additionally, it drops the following files in the affected system:

  • %windir%\winlogon32.exe - A copy of itself (Detected as Trojan-Dropper.Win32.Small.qp)
  • %windir%\winlogon32.dll - Another malware file (Detected as Trojan-Downloader.Win32.Small.anj)
  • %windir%\prefoct.dat - An empty file

As a stealth mechanism, it loads the dropped DLL, winlogon32.dll, under the legitimate process: lsass.exe.Trojan-Downloader.Win32.Small.anj, on the other hand, creates the mutex _Win_Loader__Win_Loader_. This malware attempts to connect to the following web sites to possibly download other malicious components:

  • https://www.max-stats.com/l/[REMOVED].php?i=21 Data downloaded is saved in the file, %windir%\prefoct.dat
  • https://www.teen4-sex.com/[REMOVED].dat Data downloaded is saved in the file, %wndir%\_tmp0232.exe

Small.QP then executes the downloaded file, _tmp0232.exe. Note: Both download sites are unavailable at the time of writing.There are additional details on Small.QP on F-Secure's Weblog.

Date Created: -

Date Last Modified: -