Jump to content

Trojan.Win32.FireHooker

From Wikipedia, the free encyclopedia

Trojan.Win32.FireHooker or Trojan:Win32/FireHooker is the definition (from Kaspersky Labs) of a Trojan downloader, Trojan dropper, or Trojan spy created for the Windows platform.[1] Its first known detection goes back to September, 2015, according to the AVV Trend Micro.

Malware details

[edit]

This malware requires its main component to successfully perform its intended routine as a .dll file, by the name xul.dll. The file size is about 5120 bytes.[2] The file is being dropped by an DNS blocking installer or additional installers bundled with DNSblockers.

xul.dll, which is a known Mozilla Firefox DLL, loads in order to come to action the following APIs from the DLL file

  • CERT_GetCommonName
  • NSS_CMSSignerInfo_GetSigningCertificate
  • NSS_CMSSignerInfo_Verify
  • PORT_Set_Error
  • VFY_VerifyDigestDirect[3]

Other aliases

[edit]
[edit]

References

[edit]