Trojan-Dropper:Java/Ourt.A silently installs malicious web browser extensions that inject advertising content into the victim's Facebook page and spams their friends list with messages containing malicious file attachments.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Trojan-Dropper:Java/Ourt.A is distributed in malicious VBS files attached to Facebook chat messages. The text of the message may be random, and the attached file will use a filename such as "Watch Thiss!!!.vbs" (or similar enticing wording).
If the recipient clicks on the attached file, it will silently create a folder on the recipient's machine named 'C:\MyFolderakis', into which it drops a zipped file containing 3 components: a BAT file, a Java installer and a JAR file.
The BAT file first checks if Java is installed on the machine; if not, it silently installs Java. The BAT file then runs the JAR file, which copies itself to the Startup folder to stay persistent and then silently installs malicious extensions or add-ons for both the Firefox and Chrome web browsers.
The browser extension will inject advertising content into the victim's Facebook page. It will also spam malicious messages to the victim's Facebook friends list, to further its spread.
Date Created: -
Date Last Modified: -