Jump to content

Firefox Patch Malware

Recommended Posts

I and others are receiving a full screen popup window in Firefox (47.0.1) indicating that there is an emergency Firefox security patch that needs to be downloaded. The download window shows an https:// address with a binary file typically in the mid 300k size. A search on whois shows the address to be bogus. Norton Security Suite, Malwarebytes and M-AntiExploit are not picking up on this. I have noticed this twice so far and each time the "download" address and size is different. Are you aware of this problem and is mediation in the works? I've attached a copy of one of the download links. Thanks.

7-3-2016 8-42-48 AM.jpg

Link to post
Share on other sites

That is Social Engineering.  While Social Engineering is the Human Exploit, MBAE targets software exploits.  As far as the functionality of the site is concerned, it is normal and not using software exploitation in a part of its malvertisement process.

However, Malwarebytes' Anti-Malware (MBAM) targets firefox-patch.exe and it should detect the file.  Prior versions...

MBAM detects as "Trojan.Injector"

MBAM detects as "Trojan.Kovter"

MBAM detects as "Ransom.Cerber"

MBAM detects as "Trojan.PasswordStealer

MBAM detects as "Backdoor.Cerber"


If you find an undetected sample then please submit it in  Newest Malware Threats  after reading the following on how to provide sample submissions such that MBAM can detect targeted but presently undetected threats.

Malware hunters please read
Purpose of this forum
Malware Hunters group


Edited by David H. Lipman
Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.