Trojan:Win32/Sefnit.AA

Trojan:Win32/Sefnit.AA is a trojan that may monitor Internet Explorer or Mozilla Firefox to hijack the search results for various search engines.

Installation

Trojan:Win32/Sefnit.AA drops copies of itself as the following:

• %appdata%\desktopmain32\winwirpl.dll
• %temp%\winnetdll32.dll

It creates the following registry entries so that its dropped copy automatically executes every time Windows starts:

In subkey: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "winWIRpl"
With data: "rundll32.exe "%appdata%\desktopmain32\winwirpl.dll",fxweblog bluetoothmappath"

It also creates the following registry subkeys:

• HKCU\Software\DesktopMain32\{724C8160-7961-48F1-3949-BABC81681BA7}
• HKCU\Software\DesktopMain32\{7389619F-0BDE-4841-D26F-B8BCAAF7D1A4}
• HKCU\Software\DesktopMain32\{715F009C-BF1D-4AB1-DDC0-B2BCE5543DA0}

It launches its dropped copies by running the following commands:

rundll32.exe "%appdata%\DesktopMain32\winWIRpl.dll",fxWeblog BluetoothMapPath
rundll32.exe "%temp%\winNetdll32.dll", fxWeblog ApplecrtCmds

Payload

Hijacks search engine results

Trojan:Win32/Sefnit.AA monitors Internet Explorer and Mozilla Firefox if the user is looking for something on the Internet using a search engine. If this is the case, Trojan:Win32/Sefnit.AA hijacks the search results to display arbitrary results.

Analysis by Jireh Sanico