Trojan-Dropper:Java/Ourt.A

Classification

Category:

Malware

Platform:

Java

Type:

Trojan-dropper

Aliases:

Trojan-Dropper:Java/Ourt.A

Summary

Trojan-Dropper:Java/Ourt.A silently installs malicious web browser extensions that inject advertising content into the victim's Facebook page and spams their friends list with messages containing malicious file attachments.

Removal

Technical Details

Trojan-Dropper:Java/Ourt.A is distributed in malicious VBS files attached to Facebook chat messages. The text of the message may be random, and the attached file will use a filename such as "Watch Thiss!!!.vbs" (or similar enticing wording).

If the recipient clicks on the attached file, it will silently create a folder on the recipient's machine named 'C:\MyFolderakis', into which it drops a zipped file containing 3 components: a BAT file, a Java installer and a JAR file.

The BAT file first checks if Java is installed on the machine; if not, it silently installs Java. The BAT file then runs the JAR file, which copies itself to the Startup folder to stay persistent and then silently installs malicious extensions or add-ons for both the Firefox and Chrome web browsers.

The browser extension will inject advertising content into the victim's Facebook page. It will also spam malicious messages to the victim's Facebook friends list, to further its spread.