SHA1: db7309d40faa32fb8c40b66659155ad3bedb009d
A Trojan written in JavaScript and implemented as a plug-in for Mozilla Firefox. It is distributed under the name of NetFilterPro and is presented as “additional security for safe browsing experience”. The Trojan consists of three JS files. The file responsible for performing main malicious functions is encrypted. Other two files serve the purpose of injecting the first file into webpages.
The main objective of this malicious program is to embed arbitrary content into webpages loaded in browser windows. The Trojan has a list of about 200 website addresses hard-coded in his body.
The malicious program can imitate mouse clicks of Megafon (“Мегафон”) and Beeline (“Билайн”) clients to confirm various subscriptions. If the user opens webpages of Yandex (“Яндекс”), Youtube or of such social networking websites as Vkontakte (“ВКонтакте”), Odnoklassniki (“Одноклассники”), and Facebook in the browser window, the Trojan will download a corresponding script from the remote server and execute it. As a result, the user will be redirected to some file-sharing resource employed to generate income by means of paid subscriptions. Moreover, when the victim runs a search using one of the popular search engines, the Trojan processes results and, based on them, embeds advertising banners into webpages whose addresses are displayed. To Facebook webpages, this malicious program adds an iframe element (in order to set internal variables), which allows Trojan.Ormes.186 to automatically “like” specified webpages.
If the user opens a webpage of an online casino whose address is stored in the Trojan's body, such a compromised resource will offer to download an application for a social networking website automatically redirecting the user to the Internet resource with the application. Once the victim finds themselves on that webpage, Trojan.Ormes.186 will imitate a click to confirm installation. Thus, the application will be installed without user intervention.
