Threat behavior
This threat is installed as an add-on for Chrome and Mozilla Firefox internet browsers. It does not affect Internet Explorer.
Trojan:JS/Febipos.A can be installed by the malware TrojanDropper:Win32/Febipos.A.
Once installed the trojan will check for, download, and install an updated copy of itself from the following URLs:
Chrome:
-
du-pont.info/<removed>/pt_PT/BL-chromebrasil.crx
-
le-super.info/<removed>/pt_PT/BL-chromebrasil.crx
-
supch.info/<removed>/ch_CH/chromechinaescapeone.crx
-
upbrtwo.info/<removed>/pt_BR/chromebrasilescapethree.crx
-
upsbr.info/<removed>/pt_BR/chromebrasilescapethree.crx
-
upsv-fr.info/<removed>/fr_FR/chromefranceescapeone.crx
Mozilla Firefox:
-
du-pont.info/<removed>/pt_PT/BL-mozillabrasil.xpi
-
le-super.info/<removed>/pt_PT/BL-mozillabrasil.xpi
-
supch.info/<removed>/ch_CH/mozillachinaescapeone.xpi
-
upbrtwo.info/<removed>/pt_BR/mozillabrasilescapeone.xpi
-
upsbr.info/<removed>/pt_BR/mozillabrasilescapeone.xpi
-
upsv-fr.info/<removed>/fr_FR/mozillafranceescapeone.xpi
It will then attempt to read a configuration file that tells the trojan what actions to perform. This file might be one of the following:
-
avbr.<removed>/sqlvarbr.php
-
frupsv.<removed>/sqlvarfr.php
-
le-chinatown.<removed>/sqlvarch.php
-
leferrie.<removed>/sqlvarbr.php.
-
lesmecz.<removed>/sqlvarbr.php
-
supbr.<removed>/sqlvarbr.php
The file has a list of commands for what the trojan can do in your Facebook account, including:
- Liking a page
- Sharing a post
- Posting messages
- Joining a group
- Inviting your friends to a group
- Sending messages and links via chat
- Commenting on posts
The content of these posts change regularly and can include links to Facebook pages or external websites.
Additional information
The blog post Browser extension hijacks Facebook profiles has more information about this threat.
Analysis by Jonathan San Jose.
Prevention
