Trojan.Necurs.A

By Domesticus in Trojans

Translate To:

Threat Scorecard

Popularity Rank:	15,413
Threat Level:	80 % (High)
Infected Computers:	1,041

First Seen:	September 30, 2011
Last Seen:	January 31, 2026
OS(es) Affected:	Windows

Trojan.Necurs.A is a Trojan that encompasses malware dropper, rootkit and backdoor capabilities. Trojan.Necurs.A makes use of rootkit techniques, and, thus, once installed can add a subkey into to the Windows Registry, which allows it to start automatically whenever you boot your Windows. Trojan.Necurs.A runs surreptitiously in the system background, bypassing the detection of anti-malware applications, and it makes it hard to eliminate it. Trojan.Necurs.A proliferates via unsafe web pages and enters the compromised PC without a victim's consent and awareness.

After installation, Trojan.Necurs.A downloads a list of six web addresses. Trojan.Necurs.A tries to connect to these websites over the network without your authorization once the Trojan infiltrates into the computer system. Once the connection is generated, Trojan.Necurs.A uses an HTTP protocol to download a file from one of these addresses and then launch it. Trojan.Necurs.A can also downloads and install extra malware threats. Trojan.Necurs.A disables security applications, so that it would not be found and deleted. Trojan.Necurs.A is able to randomly restart your computer system, as a result, losing all the unsaved information.

Table of Contents

Aliases

15 security vendors flagged this file as malicious.

Antivirus Vendor	Detection
Panda	Trj/Dtcontx.D
AVG	Generic32.BSSV
Fortinet	W32/Kryptik.AYQT
Sophos	Mal/Generic-S
AntiVir	TR/Symmi.18765
Kaspersky	Trojan-Dropper.Win32.Necurs.pfa
McAfee	PWS-Zbot-FASG!23C68A52087F
AVG	Dropper.Generic8.WEG
AntiVir	TR/Crypt.ZPACK.Gen
Kaspersky	Trojan-Dropper.Win32.Necurs.pfc
AVG	BackDoor.Generic15.CMMC
AhnLab-V3	Win-Trojan/Necurs.59776
Comodo	TrojWare.Win32.UMal.~A
Sophos	Troj/Necurs-M
Kaspersky	Rootkit.Win32.Necurs.he

SpyHunter Detects & Remove Trojan.Necurs.A

File System Details

Trojan.Necurs.A may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	NewRoads_V40_MSTS1_Setup.exe	fe6029c6dd77e373e51568c8c78b650e	220
Name: NewRoads_V40_MSTS1_Setup.exe MD5: fe6029c6dd77e373e51568c8c78b650e Size: 18.19 MB (18194419 bytes) Detections: 220 Type: Executable File Path: C:\Games Files\MSTS Group: Malware file Last Updated: January 31, 2026
2.	e9ed568f444e0f0f.sys	45965a29086a6943c08951dc7061eeab	7
Name: e9ed568f444e0f0f.sys MD5: 45965a29086a6943c08951dc7061eeab Size: 63.1 KB (63104 bytes) Detections: 7 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: December 20, 2012
3.	syshost.exe	7063a79e9065bdb51072478eca7a470c	6
Name: syshost.exe MD5: 7063a79e9065bdb51072478eca7a470c Size: 58.88 KB (58880 bytes) Detections: 6 Type: Executable File Path: %LOCALAPPDATA%\{B88B43D0-D723-2B15-73EF-722253A721E6} Group: Malware file Last Updated: April 22, 2013
4.	22a2a5937d037a2b.sys	075f1f21fd1dcf6c7f1144cc2e9fe3b6	5
Name: 22a2a5937d037a2b.sys MD5: 075f1f21fd1dcf6c7f1144cc2e9fe3b6 Size: 70.65 KB (70656 bytes) Detections: 5 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: October 17, 2012
5.	147.sys	ec44ddcec6418a6bcd83b02ae38f1b09	4
Name: 147.sys MD5: ec44ddcec6418a6bcd83b02ae38f1b09 Size: 35.32 KB (35328 bytes) Detections: 4 Type: System file Path: C:\rogueware samples\others\147.sys Group: Malware file Last Updated: May 6, 2024
6.	installer.exe	4250135cb2e36bbc0fd16953d8dd5b51	3
Name: installer.exe MD5: 4250135cb2e36bbc0fd16953d8dd5b51 Size: 801.69 KB (801699 bytes) Detections: 3 Type: Executable File Path: %USERPROFILE%\Bureau Group: Malware file Last Updated: October 6, 2011
7.	Recycle.Bin.exe	4fdd0faad2727aa09c87c7b0cb27354a	3
Name: Recycle.Bin.exe MD5: 4fdd0faad2727aa09c87c7b0cb27354a Size: 157.69 KB (157696 bytes) Detections: 3 Type: Executable File Path: %SystemDrive%\Recycle.Bin Group: Malware file Last Updated: January 20, 2022
8.	edsmgr.exe	22efaf078dd62016c49020143877fd0d	3
Name: edsmgr.exe MD5: 22efaf078dd62016c49020143877fd0d Size: 78.84 KB (78848 bytes) Detections: 3 Type: Executable File Path: %WINDIR%\system32 Group: Malware file Last Updated: October 3, 2011
9.	blammi.exe	6c7bfaf7d9a4cdfffbe4d402c7001e56	2
Name: blammi.exe MD5: 6c7bfaf7d9a4cdfffbe4d402c7001e56 Size: 749.56 KB (749568 bytes) Detections: 2 Type: Executable File Path: %APPDATA%\Blammi Group: Malware file Last Updated: October 5, 2011
10.	6ef24294c953172f.sys	72a6c1fd16ed06bb7b1474de33b78a49	2
Name: 6ef24294c953172f.sys MD5: 72a6c1fd16ed06bb7b1474de33b78a49 Size: 69.88 KB (69888 bytes) Detections: 2 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: September 15, 2020
11.	41fb2af0cd745ae6.exe	4256f11cbc40be771917f88b36d2f4fc	1
Name: 41fb2af0cd745ae6.exe MD5: 4256f11cbc40be771917f88b36d2f4fc Size: 321.02 KB (321024 bytes) Detections: 1 Type: Executable File Path: %USERPROFILE%\Local Settings\Application Data Group: Malware file Last Updated: September 30, 2011
12.	0.3826909899607682.exe	1d81e09b7dbc01068d3572ac9eb2f512	1
Name: 0.3826909899607682.exe MD5: 1d81e09b7dbc01068d3572ac9eb2f512 Size: 321.02 KB (321024 bytes) Detections: 1 Type: Executable File Path: %TEMP% Group: Malware file Last Updated: October 10, 2011
13.	2479e.sys	ed8a2b1018f0b3e846b088b7bbe51585	1
Name: 2479e.sys MD5: ed8a2b1018f0b3e846b088b7bbe51585 Size: 43 KB (43008 bytes) Detections: 1 Type: System file Path: %WINDIR%\system32\drivers Group: Malware file Last Updated: January 24, 2012
14.	a657181eb7ee61.sys	87a6954ec6a20cb2c6d590dbf2d18f2d	1
Name: a657181eb7ee61.sys MD5: 87a6954ec6a20cb2c6d590dbf2d18f2d Size: 71.49 KB (71496 bytes) Detections: 1 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: October 29, 2012
15.	c7b1929d221268f1.sys	2e992a5c03ed97cf415e49e3b08ea6eb	1
Name: c7b1929d221268f1.sys MD5: 2e992a5c03ed97cf415e49e3b08ea6eb Size: 69.72 KB (69720 bytes) Detections: 1 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: October 5, 2012
16.	7a513dead4b2135e.sys	f528a809992ea627e670e5c8d1c8fdff	1
Name: 7a513dead4b2135e.sys MD5: f528a809992ea627e670e5c8d1c8fdff Size: 67.54 KB (67544 bytes) Detections: 1 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: October 18, 2012
17.	e42239653e830f5b.sys	0907292986e05a8752bc1863556d229e	1
Name: e42239653e830f5b.sys MD5: 0907292986e05a8752bc1863556d229e Size: 59.77 KB (59776 bytes) Detections: 1 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: April 17, 2013
18.	b67753265c84af4.sys	1fb5b5f1e8ee11c948c0389ede1f8e8e	1
Name: b67753265c84af4.sys MD5: 1fb5b5f1e8ee11c948c0389ede1f8e8e Size: 68.4 KB (68408 bytes) Detections: 1 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: February 25, 2013
19.	5071c.sys	8f9ebee084f45c6b7378ea9c3bbbcea5	1
Name: 5071c.sys MD5: 8f9ebee084f45c6b7378ea9c3bbbcea5 Size: 69.19 KB (69192 bytes) Detections: 1 Type: System file Path: %WINDIR%\system32\drivers Group: Malware file Last Updated: March 4, 2013
20.	86dadcaae13b6bc6.sys	279e87cc664b6e77c05560e45ef517f1	1
Name: 86dadcaae13b6bc6.sys MD5: 279e87cc664b6e77c05560e45ef517f1 Size: 59.13 KB (59136 bytes) Detections: 1 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: March 29, 2013
21.	662f2.sys	4e760d8f966a1d9f3bbe4afeb336e9da	1
Name: 662f2.sys MD5: 4e760d8f966a1d9f3bbe4afeb336e9da Size: 58.11 KB (58112 bytes) Detections: 1 Type: System file Path: %WINDIR%\system32\drivers Group: Malware file Last Updated: January 5, 2013
22.	61a57491bc0649b8.sys	8c55911cde8dd5c45e6be123f6ceaca1	1
Name: 61a57491bc0649b8.sys MD5: 8c55911cde8dd5c45e6be123f6ceaca1 Size: 46.26 KB (46264 bytes) Detections: 1 Type: System file Path: %WINDIR%\System32\drivers Group: Malware file Last Updated: December 18, 2012
23.	edsmgr.exe
Name: edsmgr.exe Type: Executable File Group: Malware file
24.	121ecb4.sys
Name: 121ecb4.sys Type: System file Group: Malware file
25.	Recycle.Bin.exe
Name: Recycle.Bin.exe Type: Executable File Group: Malware file
26.	41fb2af0cd745ae6.exe
Name: 41fb2af0cd745ae6.exe Type: Executable File Group: Malware file

More files

Analysis Report

General information

Family Name:	Trojan.Necurs.A
Signature status:	No Signature

Known Samples

MD5: 8f4bf05cee776bec34d66dae045faca4

SHA1: a9053bcb206ff07b7534e7c4cee1740e3cc01338

SHA256: 0E0B83B3BE0DB72343B053A7AD47B04043C5ABF003A54DDA93FB14221B52DF29

File Size: 2.11 MB, 2114560 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have security information
File has TLS information
File is 32-bit executable
File is either console or GUI application
File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)
File is not packed

IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

File Traits

No Version Info
x86

Block Information

Total Blocks:	5,790
Potentially Malicious Blocks:	7
Whitelisted Blocks:	5,325
Unknown Blocks:	458

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

... Data truncated

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category	API
Network Winsock2	WSAStartup

EnigmaSoft’s Payment Processor Digital River GmbH Filing for Bankruptcy Does Not Impact SpyHunter Customers’ Anti-Malware Protection

Search

Change Region

Trojan.Necurs.A

Threat Scorecard

EnigmaSoft Threat Scorecard

Aliases

SpyHunter Detects & Remove Trojan.Necurs.A

File System Details

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

File Traits

Block Information

Block Information

Visual Map

Windows API Usage

Windows API Usage

Submit Comment

Trending

MacTonic

New VBScript IE Exploit May Plant Malware on Windows XP

Backdoor.MSIL.Spy.Agent.DAA

Most Viewed

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen

How to Fix 'macOS cannot verify that this app is...