TrojanDownloader:Win32/Wintrim.BX

TrojanDownloader:Win32/Wintrim.BX is a component of the greater Win32/Wintrim family that is used for downloading and installing additional Wintrim components. Win32/Wintrim is a family of trojans that display pop-up advertisements depending on the user's keywords and browsing history. Its variants can also monitor the user's activities, download applications, and send system information back to a remote server.

TrojanDownloader:Win32/Wintrim.BX may be offered in the wild masquerading as a number of different applications, including the following, for example:

 

Official Emule

 

Live Player

 
The distributors of this family of malware rely on social engineering techniques to convince users to install these malicious applications.

Downloads and Executes Arbitrary Files
When executed the installer downloads files to %programfiles%\<Application Name>, but also downloads a trojan to %APPDATA%\<random name>.exe and executes it.
 
The installer may then display a 'successful installation' message in the browser, for example:

For more information, please see the Win32/Wintrim family description elsewhere in our encyclopedia.
 
Analysis by Ray Roberts