Trojan:Win32/Necurs.gen!A

Installation

Trojan:Win32/Necurs.gen!A drops the following file:

• %windir% \installer\{GUID}\syshost.exe - also detected as Trojan:Win32/Necurs.gen!A

{GUID} is a random 16-digit hexadecimal number.

It installs the file as a service with the display name "Syshost.exe" and the group name "Boot Bus Extender". Installing itself as a service lets it to run every time Windows starts.

It also creates the following named pipe and events to make sure that only one instance of itself is running at any particular time:

• named pipe \\.\NtSecureSys
• event Global\NitrGB
• event Local\NitrGB

Trojan:Win32/Necurs.gen!A injects code into all running processes. It does this to hide its behavior from antivirus software.

It connects to the following domains to check if your PC is connected to the Internet, and to get the current date and time. These websites are not affiliated with the malware in any way:

• facebook.com
• microsoft.com

Payload

Connects to certain servers

Trojan:Win32/Necurs.gen!A connects to the following servers every 20 seconds to send and receive messages:

• 0.pool.ntp.org
• 1.pool.ntp.org

At the time of publishing, these servers were unavailable.

Analysis by Ferdinand Plazo