TROJ_SIREFEF.BV

This Trojan may be installed to the system by another file and acts as a malware component. Once running, it performs some of its payloads. The downloaded files are stored in a certain folder.It also stops a service related to Windows Firewall.

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware. It arrives as a component bundled with malware/grayware packages. It may be unknowingly downloaded by a user while visiting malicious websites.

It may be injected into processes running in memory.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

It arrives as a component bundled with malware/grayware packages.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan creates the following folders:

• %Windows%\assembly\tmp\U\

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It may be injected into processes running in memory.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager\SubSystems
consrv = "{malware path and file name}"

NOTES:

It may be installed to the system by another file and acts as a malware component. Once running, it performs some of its payloads which include the following:

• Downloading an updated copy of itself or another malware
• Executing the downloaded file

The downloaded files are stored in the following folder:

• %Windows%\assembly\tmp\U\

It also stops the following service related to Windows Firewall:

• MpsSvc