TROJ_MEDFOS.FVL

This Trojan modifies a certain file where it inserts a line line under the [ExtensionDirs] section.

This Trojan may be dropped by other malware.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan may be dropped by other malware.

Installation

This Trojan adds the following processes:

• default browser process

It creates the following folders:

• %Application Data%\{AF8106AD-BA42-11E1-8270-B8AC6F996F26}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Mozilla\
Firefox\Extensions
{AF8106AD-BA42-11E1-8270-B8AC6F996F26} = %Application Data%\{AF8106AD-BA42-11E1-8270-B8AC6F996F26}

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}oadfile.com/file/id=AwAyAAEAyq8QAAEFAJAAAAAAAAAAIwwGEAsAAACtBoGv4RFCuqy4cIImb5lvVVVVVVVVVVVVVVVVVVVVVQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADRW&c=3
• http://{BLOCKED}load.com/file/id=BAAyAAEAvTwQAAEFBgAAAAAAAAAAAAAAAAAAAAAjDAYQCwAAAO shSLhEUC6rLhwgiZvmW8AAFVVVVVVVVVVVVVVVVVVVVVPTs0BuoP8V5PYPABURUtFV19WTn9XR08uTEtGMjYyAhORIicbl80HAAAAAAA0VgAA&rt=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

As of this writing, the said sites are inaccessible.

NOTES:

This Trojan modifies the file %User Profile%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions.ini where it inserts the following line under the [ExtensionDirs] section:

• %Application Data%\{AF8106AD-BA42-11E1-8270-B8AC6F996F26}