TROJ_MEDFOS.XM

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following folders:

• %Application Data%\Search Settings
• %User Temp%\ns{random}.tmp

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops and executes the following files:

• %Application Data%\Search Settings\{random}.dll
• %User Temp%\ns{random}.tmp\{random}.dll

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Search Settings = "Rundll32.exe %Application Data%\Search Settings\{random}.dll,gss_krb5_copy_ccache"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Search Settings

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Search Settings
{CLSID} = "{Hex Values}"

NOTES:
This trojan monitors the system's browsing activities and may redirect traffic to another URL when one of the following strings are found:

• Google
• Yahoo
• Facebook
• Bing
• Aol
• Youtube
• Msn
• Hotmail
• Gmail
• Lavasoft
• Blekko
• Nortonsafe.search.ask.com
• Isearch.avg
• Microsoft.com
• Live.com

This may redirect this traffic to gain money as referrer or to access another malicious URL.

It records browser activies when the following actions are made:

• login
• tweet
• faq
• terms
• conact
• forgotpassword
• signup
• mailto
• playback