Posté par: igor51 le novembre 19, 2013, 19:06:42
In a previous blog post we discussed Trojan:JS/Febipos.A, a malicious browser extension that targets the Facebook profiles of Google Chrome and Mozilla Firefox users. We recently came across a new Febipos sample that was specifically developed for Internet Explorer - we detect it as Trojan:Win32/Febipos.B!dll.
This trojan is a browser helper object that loads a JavaScript to Internet Explorer. We detect the loaded JavaScript as Trojan:JS/Febipos.E. The plugin tries to look legitimate by calling itself MicrosoftSecurityPlugin when viewed in Internet Explorer add-ons.
Figure 1: The plugin tries to look legitimate in Internet Explorer add-ons
Spamming links on Facebook
When installed and loaded successfully Trojan:Win32/Febipos.B!dll will attempt to load a configuration file that it downloads from supbr.info/<removed>.php. It can then access a logged in Facebook account to:
- Like a page
- Share
- Post
- Join a group
- Invite friends to a group
- Chat with your friends
- Comment on a post
We have seen it post the following messages in Portuguese on the wall of a logged in Facebook account. It can also tag several of the affected user’s friends:
- Encontrei um vídeo no Youtube ensinando a ganhar $$ na Internet pelo Google! Acho que vale a pena
I found a video on Youtube teaching how to earn $$ on the Internet through Google! I think it’s worth it. - Nem eu acredito, mas é verdade.
Even I don’t believe it, but it’s true. - Dificuldades para PERDER PESO? Com ULTRA SLIM você emagrece sem sofrer!
Struggling to lose weight? With ULTRA SLIM you lose weight without suffering! - PERCA PESO, GANHE SAÚDE E AUTO-ESTIMA. É DEPENDE DE VOCÊ.
Lose weight, gain in health and self-steem. It’s only up to you. - Encontrei um vídeo no Youtube ensinando a ganhar $$ na Internet pelo Google!
I found a video on Youtube teaching how to earn $$ on the Internet through Google! - Oportunidade: Google paga R$160 por hora para trabalhar em Casa!
Opportunity: Google pays R$ 160 per hour to work from home! - Ganhe R$15.000 por mês trabalhando em Casa na Internet. Acesse o Link e saiba como!
Earn R$15,000 per month working from home on the Internet. Click on the link and find out how!
One of the following URLs is also included in the message:
- dl.dropboxusercontent.com/<removed>/aan57i7rfpx6qo0/index.html
- dl.dropboxusercontent.com/<removed>/kzsdfkep25dz1pi/index.html
- dl.dropboxusercontent.com/<removed>/inxtfvhqti5hvvr/index.html
It may also use one of the following images:
Figure 2: An example of the images used by Trojan:Win32/Febipos.B!dll in Facebook spam
Here is an example of the Facebook post:
Figure 3: An example Trojan:Win32/Febipos.B!dll Facebook post
When someone clicks on the link in the message, they are redirected to mprptrk.com/<removed>/v294v294e4p233r224w2t254/. This site will then redirect again to one of the following URLs:
- www.ultraslimsystem.com.br/<removed>/
- gazetadaweb.com/<removed>/
Installation
We have seen Trojan:Win32/Febipos.B!dll being dropped and loaded by Trojan:Win32/Febipos.B with the path and filename %appdata%\WService.dll. It is loaded using the legitimate Windows application named regsvr32.exe. This application is used to register dynamic-link libraries and ActiveX controls in the registry.
The trojan creates the following registry entries to register itself as a browser helper object:
- HKEY_CLASSES_ROOT\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A}
(default) = "MicrosoftSecurityPlugin" - HKEY_CLASSES_ROOT\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A}\InProcServer32
(default) = "%appdata%\WService.dll" - HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A}
(default) = "MicrosoftSecurityPlugin" - HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A}\InProcServer32
(default) = "%appdata%\WService.dll" - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3543619C-D563-43f7-95EA-4DA7E1CC396A}
It will also create the following registry entry to ensure it is only loaded in Internet Explorer and not in Windows Explorer:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3543619C-D563-43f7-95EA-4DA7E1CC396A}
NoExplorer = dword:00000001
The following registries entries are also created to disable some Internet Explorer notifications:
- This will disable the IE notification to the user that the add-on is ready to use
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext
IgnoreFrameApprovalCheck = dword:00000001 - This will disable the add-on performance IE notifications
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext
DisableAddonLoadTimePerformanceNotifications = dword:00000001
All of the above information was found at the time of our analysis; however, these websites can change at any time. In any case, we always recommend you keep your security products up-to-date with the latest definitions to help reduce your change of infection.
Jonathan San Jose
MMPC
Sha1s:
5cbd9c1e870b09fdd4b67e7610acbea8dddee9bd - Trojan:Win32/Febipos.B
361546e95a79b96a15e15ab82b1849f68b7381b2 - Trojan:Win32/Febipos.B!dll
bad556fb373e14f7041b3361ca450b2156a5ecda - Trojan:JS/Febipos.E
Source: Febipos for Internet Explorer (http://blogs.technet.com/b/mmpc/archive/2013/11/14/febipos-for-internet-explorer.aspx)