TrojanDownloader:Win32/Onkods is a small executable, usually between 6kB and 25kB in size, that downloads and runs other malware.
We have seen it distributed with the file name IMG<10 digits>-JPG.scr, for example IMG1337019400-JPG.scr.
When run, TrojanDownloader:Win32/Onkods contacts a server, from which it can download other malware files. The file is saved to either %TEMP%, or the directory where Win32/Onkods is running from.
It then runs the downloaded file.
Examples of servers contacted by Win32/Onkods include:
We have seen Win32/Onkods downloading the following malware families:
Analysis by David Wood
The following could indicate that you have this threat on your PC:
- You have this file: