Installation
The main component (DLL file)
When run, variants of Win32/Medfos copy themselves as a DLL file with a random name to the %APPDATA% folder. In the wild we have observed variants using the following file names:
-
%APPDATA%\pcpat.dll
-
%APPDATA%\tpleto.dll
Note: %APPDATA% refers to a variable location that is determined by the malware by querying the operating system. The default location for the Application Data folder for Windows 2000, XP, and 2003 is "C:\Documents and Settings\<user>\Application Data". For Windows Vista and 7, the default location is "C:\Users\<user>\AppData\Roaming".
If you are logged on as an administrator, Win32/Medfos modifies the following registry entry to ensure that its copy runs at each Windows start:
In subkey: HKLM\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file, without the extension>", for example "pcpat"
With data: "rundll32.exe <name of DLL file>,<random export name>", for example "rundll32.exe pcpat.dll,AInputStream"
If you are not logged on as an administrator, the malware modifies the following registry entry to ensure that its copy runs at each Windows start:
In subkey: HKCU\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file, without the extension>", for example "pcpat"
With data: "rundll32.exe <name of DLL file>,<random export name>", for example "rundll32.exe pcpat.dll,AInputStream"
Once it has installed itself in your computer, it connects to "78.140.131.158" to report that your computer has been infected.
The payload files (search redirection components)
The malware may download and run a DLL file from "78.140.131.158" with a random name to the %TEMP% folder, for example:
%TEMP%\bdylut.dll
Note: %TEMP% refers to a variable location that is determined by the malware by querying the operating system. The default location for the Temporary files folder for Windows 2000, XP, and 2003 is "C:\Documents and Settings\<user>\Local settings\Temp". For Windows Vista and 7, the default location is "C:\Users\<user name>\AppData\Local\Temp".
This file is detected as Trojan:Win32/Medfos.B, which is the search-engine redirection component of the Win32/Medfos family.
If you are logged on as an administrator, Win32/Medfos modifies the following registry entry to ensure that the downloaded file runs at each Windows start:
In subkey: HKLM\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file>", for example "bdylut"
With data: "rundll32.exe %TEMP%\<downloaded file>,<random export name>", for example "rundll32.exe C:\Users\<user name>\AppData\Local\Temp\bdylut.dll,ExceptionMatches"
If you are not logged on as an administrator, the malware modifies the following registry entry to ensure that the downloaded file runs at each Windows start:
In subkey: HKCU\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file>", for example "bdylut"
With data: "rundll32.exe %TEMP%\<downloaded file>,<random export name>", for example "rundll32.exe C:\Users\<user name>\AppData\Local\Temp\bdylut.dll,ExceptionMatches
The malware injects the downloaded file into Internet Explorer processes to enable its Internet search-redirection payload.
Win32/Medfos
may install a search-engine hijack extension for Mozilla Firefox. This extension is also part of Trojan:Win32/Medfos.B, and may be detected as Trojan:JS/Medfos.A.
The extension is installed as %LOCALAPPDATA%\{<random unique identifier>}\chrome\content\browser.xul, for example %LOCALAPPDATA%\{535C840F-E52A-11E1-8270-B8AC6F996F26}\chrome\content\browser.xul.
Note: %LOCALAPPDATA% refers to a variable location that is determined by the malware by querying the operating system. The default location for the Local Application Data folder for Windows 2000, XP, and 2003 is "C:\Documents and Settings\<user>\Application Data". For Windows Vista and 7, the default location is "C:\Users\<user>\AppData\Local".
In the wild we have observed the Firefox extension with the following names:
-
Mozilla Safe Browsing 2.0.14
-
Traqnslate This! 2.0
It also installs an extension for Google Chrome as:
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\cdjbnddbclciabnckgeahmneohjlahdm
This file is detected as Trojan:JS/Medfos.B and may have the name ChromeUpdateManager:
Payload
Redirects Internet search results
Win32/Medfos
monitors the searches you make with the following search engines:
-
AOL
-
Ask
-
Bing
-
Google
-
Yahoo
The malware sends your search queries and their results to a remote server.
We have observed variants of Win32/Medfos connecting to the following remote servers:
-
85.17.132.53
-
4.clickfeedbestppc.com
When you click the search result, the malware redirects you to a URL that it has retrieved from the remote server.
You could be redirected to advertisements or to the actual search result. In the wild, we observed that search results were redirected to "googleads.l.doubleeclick.net".
Generates click fraud
Win32/Medfos
, specifically, Trojan:Win32/Medfos.X, creates a hidden iexplore.exe process to connect to the server at "46.165.221.199".
Once connected, it gets HTML data that generates hidden clicks to a specified website. This is to generate clicks for the website, which may result in profit for the site owner.
Related encyclopedia entries
Blacole exploit kit
TrojanDownloader:Win32/Beebone
Win32/Sirefef
Trojan:Win32/Medfos.B
Trojan:JS/Medfos.A
Trojan:JS/Medfos.B
Analysis by Shawn Wang
