TROJ_DOFOIL.GE

TROJ_DOFOIL.GE is a Trojan downloader often identified with the string 'dofoil'. Like most Trojans, TROJ_DOFOIL.G does not have the capacity to spread on its own, usually requiring a social media attack in order to enter the victim's computer (often through malicious email attachments). While members of TROJ_DOFOIL.GE family have been around for a longer time, TROJ_DOFOIL.GE in particular was first seen in the wild in February of 2012. TROJ_DOFOIL.GE attacks 32-bit Windows operating systems prior to Windows Vista, although this does not mean that Windows Vista and Windows 7 are completely immune. Basically, TROJ_DOFOIL.GE will install its executable file and then make changes to the Windows Registry which allows TROJ_DOFOIL.G to start up automatically whenever the victim starts up Windows. Once TROJ_DOFOIL.GE has done this, TROJ_DOFOIL.GE and downloads certain malicious files. According to ESG security researchers, TROJ_DOFOIL.GE has been linked so far to three kinds of other Trojans: a spy Trojan that can steal information and upload it to a file sharing service, a Trojan infection designed to install a fake anti-virus on the victim's computer system and a Trojan in the Zbot family (a family of malware most commonly designed to steal banking data such as credit card and account numbers). Even though TROJ_DOFOIL.GE does not attack a computer system itself, it downloads and installs numerous malware infections onto the victim's computer system which can do anything from steal the victim's personal information to attempt to scam the victim with fake security software.

TROJ_DOFOIL.GE Has Been Linked to a File-Stealing Malware Attack

While many spy Trojans upload information to a remote server, TROJ_DOFOIL.GE has been known to install a particular spy Trojan that targets files created in Microsoft Excel and Microsoft Word and then uploads them to Sendspace.com, a website often used to share large files from one computer user to another. This is a unique kind of attack that my bring about a new trend in spy Trojans, allowing criminals to use these kinds of websites for receiving stolen data instead of requiring them to set up a server which may be more easily traced. The version of TROJ_DOFOIL.GE that carries this particular spy Trojan attack is being spread through a phishing email pretending to contain an invoice from messenger service Federal Express. The attached invoice is actually an executable file designed to infect the victim's computer with TROJ_DOFOIL.GE.