Threat behavior
Trojan:Win32/Oficla.H!dll is a trojan that attempts to inject code into a running process to download a rogue security program identified as
TrojanDownloader:Win32/FakeScanti.
Installation
When run, the trojan drops a copy of itself into the Windows temporary files folder using a random file name and a ".TMP" file extension, for example, "%TEMP%\e.tmp". It is copied as a randomly named file into the Windows system folder such as the following:
<system folder>\aqlb.hjo
Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.
The registry is modified to run this copy at each Windows start as in the following example:
Modifies value: "Shell"
From data: "explorer.exe" (default value)
To data: "explorer.exe rundll32.exe aqlb.hjo lhoweid"
In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Note: In the above, the data "aqlb.hjo lhoweid" may change among installations.
It may inject code into the running process "svchost.exe".
Payload
Downloads other malware
- topdns341.com
- avppi.com
- ecountertracker.cc
- freecapch.info
- apsight.ru
Analysis by Elda Dimakiling
Prevention