Installation
The main component (DLL file)
When run, variants of Win32/Medfos copy themselves as a DLL file with a random name to the %APPDATA% folder. In the wild we have observed variants using the following file names:
If you are logged on as an administrator, Win32/Medfos modifies the following registry entry so that it runs each time you start your PC:
In subkey: HKLM\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file, without the extension>", for example "pcpat"
With data: "rundll32.exe <name of DLL file>,<random export name>", for example "rundll32.exe pcpat.dll,AInputStream"
If you are not logged on as an administrator, the malware modifies the following registry entry so that it runs each time you start your PC:
In subkey: HKCU\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file, without the extension>", for example "pcpat"
With data: "rundll32.exe <name of DLL file>,<random export name>", for example "rundll32.exe pcpat.dll,AInputStream"
Once it has installed itself on your PC, it connects to "78.140.131.158" to report the infection.
The payload files (search redirection components)
The malware can download and run a DLL file from "78.140.131.158" with a random name to the %TEMP% folder, for example %TEMP%\bdylut.dll.
This file is detected as Trojan:Win32/Medfos.B, which is the search-engine redirection component of the Win32/Medfos family.
If you are logged on as an administrator, Win32/Medfos modifies the following registry entry so that it runs each time you start your PC:
In subkey: HKLM\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file>", for example "bdylut"
With data: "rundll32.exe %TEMP%\<downloaded file>,<random export name>", for example "rundll32.exe C:\Users\<user name>\AppData\Local\Temp\bdylut.dll,ExceptionMatches"
If you are not logged on as an administrator, the malware modifies the following registry entry so that it runs each time you start your PC::
In subkey: HKCU\Software\Microsoft\Windows\Currentversion\Run
Sets value: "<name of DLL file>", for example "bdylut"
With data: "rundll32.exe %TEMP%\<downloaded file>,<random export name>", for example "rundll32.exe C:\Users\<user name>\AppData\Local\Temp\bdylut.dll,ExceptionMatches
The malware injects the downloaded file into Internet Explorer processes to enable its Internet search-redirection payload.
Win32/Medfos may install a search-engine hijack extension for Mozilla Firefox. This extension is also part of Trojan:Win32/Medfos.B, and may be detected as Trojan:JS/Medfos.A.
The extension is installed as %LOCALAPPDATA%\{<random unique identifier>}\chrome\content\browser.xul, for example %LOCALAPPDATA%\{535C840F-E52A-11E1-8270-B8AC6F996F26}\chrome\content\browser.xul.
In the wild we have observed the Firefox extension with the following names:
- Mozilla Safe Browsing 2.0.14
- Traqnslate This! 2.0
It also installs an extension for Google Chrome as %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\cdjbnddbclciabnckgeahmneohjlahdm.
This file is detected as Trojan:JS/Medfos.B and can have the name ChromeUpdateManager:
Payload
Redirects Internet search results
Win32/Medfos monitors the searches you make with the following search engines:
- AOL
- Ask
- Bing
- Google
- Yahoo
The malware sends your search queries and their results to a remote server.
We have observed variants of Win32/Medfos connecting to the following remote servers:
- 85.17.132.53
- 4.clickfeedbestppc.com
When you click the search result, the malware redirects you to a URL that it has retrieved from the remote server.
You could be redirected to advertisements or to the actual search result. In the wild, we observed that search results were redirected to "googleads.l.doubleeclick.net".
Generates click fraud
Win32/Medfos, specifically, Trojan:Win32/Medfos.X, creates a hidden iexplore.exe process to connect to the server at "46.165.221.199".
Once connected, it gets HTML data that generates hidden clicks to a specified website. This is to generate clicks for the website, which may result in profit for the site owner.
Related encyclopedia entries
Blacole exploit kit
TrojanDownloader:Win32/Beebone
Win32/Sirefef
Trojan:Win32/Medfos.B
Trojan:JS/Medfos.A
Trojan:JS/Medfos.B
Analysis by Shawn Wang
