Extenbro DNS Trojan

First observed in early 2019, Extenbro is a trojan used in adware campaigns to alter user's Domain Name Server (DNS) settings.

Threat ID:: CC-3151
Category:: Trojan
Threat Severity:: Low
Threat Vector:: Download
Published:: 18 July 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

First observed in early 2019, Extenbro is a trojan used in adware campaigns to alter user's Domain Name Server (DNS) settings.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

Extenbro is typically delivered by an unknown bundler along with other potentially unwanted applications.

Once installed, Extenbro will alter the system's DNS settings, replacing the previous addresses with its own in order to prevent the user from reaching online security services. A randomly-named task is used to ensure these setting are reapplied after every reboot. It will then add its own certificate to the system store and alter registry keys to disable IPv6. Extenbro will also alter the Mozilla Firefox user.js file to force Firefox to use this store.

Remediation steps

Type	Step
	As Extenbro prevents security services from accessing the Internet, it is likely that organisations will have to manually alter affected systems DNS settings before attempting to remediate. Please follow the below guidance to do so: Open Windows Advanced TCP/IP Settings Navigate to the DNS tab. Replace Extenbro's DNS IP addresses with your preferred DNS settings. Save the new settings. Please note that restarting the system at this point will result in Extenbro's settings being reapplied. Open Microsoft Certificates Management Console. Navigate to the Certificates sub-folder of the ROOT folder. Identify and remove Extenbro's certificate. Restart any running browsers. Additionally, to prevent and detect a trojan infection, ensure that: A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails. All operating systems, anti-virus and other security products are kept up-to-date. Regular anti-virus and security scans are performed on your organisation’s estate. All day-to-day computer activities such as email and internet are performed using non-administrative accounts. Strong password policies are in place. Network, proxy and firewall logs should be monitored for suspicious activity. User accounts accessed from affected devices should be reset on a clean computer. Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Type

Step

As Extenbro prevents security services from accessing the Internet, it is likely that organisations will have to manually alter affected systems DNS settings before attempting to remediate. Please follow the below guidance to do so:

Open Windows Advanced TCP/IP Settings
Navigate to the DNS tab.
Replace Extenbro's DNS IP addresses with your preferred DNS settings.
Save the new settings. Please note that restarting the system at this point will result in Extenbro's settings being reapplied.
Open Microsoft Certificates Management Console.
Navigate to the Certificates sub-folder of the ROOT folder.
Identify and remove Extenbro's certificate.
Restart any running browsers.

Additionally, to prevent and detect a trojan infection, ensure that:

A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
All operating systems, anti-virus and other security products are kept up-to-date.
Regular anti-virus and security scans are performed on your organisation’s estate.
All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
Strong password policies are in place.
Network, proxy and firewall logs should be monitored for suspicious activity.
User accounts accessed from affected devices should be reset on a clean computer.
Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Last edited: 14 February 2020 2:42 pm