W32/Small.AUX!tr

Analysis

W32/Small.AUX-tr is a Trojan Downloader. Although it does not have any spreading capabilities by itself, upon execution it silently connects to a malicious web site over the internet and downloads 2 malicious files from there; once retrieved, those are in turn run on the infected computer "under the cloak". The 2 malicous files - named tool1.exe and tool2.exe - are located on http://www.vxiframe.biz, and are detected by Fortinet as W32/Small.AQT-tr and W32/LowZones.Y-tr respectively.