Trojan-Dropper:Java/Ourt.A silently installs malicious web browser extensions that inject advertising content into the victim's Facebook page and spams their friends list with messages containing malicious file attachments.


Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Trojan-Dropper:Java/Ourt.A is distributed in malicious VBS files attached to Facebook chat messages. The text of the message may be random, and the attached file will use a filename such as "Watch Thiss!!!.vbs" (or similar enticing wording).

If the recipient clicks on the attached file, it will silently create a folder on the recipient's machine named 'C:\MyFolderakis', into which it drops a zipped file containing 3 components: a BAT file, a Java installer and a JAR file.

The BAT file first checks if Java is installed on the machine; if not, it silently installs Java. The BAT file then runs the JAR file, which copies itself to the Startup folder to stay persistent and then silently installs malicious extensions or add-ons for both the Firefox and Chrome web browsers.

The browser extension will inject advertising content into the victim's Facebook page. It will also spam malicious messages to the victim's Facebook friends list, to further its spread.

Date Created: -

Date Last Modified: -