Home / malwarePDF  


First posted on 09 March 2018.
Source: Microsoft

Aliases :

There are no other names known for TrojanDownloader:Win32/Dofoil.S.

Explanation :

TrojanDownloader:Win32/Dofoil.S is a trojan that silently downloads and installs other programs without consent. This could include the installation of additional malware or malware components to an affected computer.


When executed, TrojanDownloader:Win32/Dofoil.S copies itself to c:\documents and settings\administrator\start menu\programs\startup\kiaqas.exe.


Contacts remote hosts
TrojanDownloader:Win32/Dofoil.S may contact the following remote hosts using port 80:

  • bm1.net.ua
  • redsfs.net.ua
  • sasv.ru

Commonly, malware may contact a remote host for the following purposes:
  • To confirm Internet connectivity
  • To report a new infection to its author
  • To receive configuration or other data
  • To download and execute arbitrary files (including updates or additional malware)
  • To receive instruction from a remote attacker
  • To upload data taken from the affected computer

This malware description was produced and published using our automated analysis system's examination of file SHA1 115f511ffdc08ba0c9cb8f113174e22a16c54bee.

Last update 09 March 2018