Trojan:Win32/Swrort.A

Trojan:Win32/Swrort.A is a detection for files that try to connect to a remote server. Once connected, an attacker can perform malicious routines such as downloading other files.

They can be installed from a malicious site or used as payloads of exploit files.

Once executed, Trojan:Win32/Swrort.A may connect to a remote server using different port numbers. Once connected, an attacker can perform malicious routines such as downloading other malware and executing them.

We have seen this threat connect to the following servers:

• 202.54.98.156 via TCP port 4444
• 10.10.10.31 via TCP port 443
• 188.50.82.246 via TCP port 1234 

Analysis by Elda Dimakiling