Virus:TR/Vundo.HY
Date discovered:13/06/2008
Type:Trojan
In the wild:No
Reported Infections:Low to medium
Distribution Potential:Low
Damage Potential:Medium
Static file:Yes
File size:321.536 Bytes
MD5 checksum:985c2011d7971e33d9ace5892a51f28b
IVDF version:7.00.04.187 - Friday, June 13, 2008

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Sophos: Troj/FakeAle-CB
   •  Eset: a variant of Win32/Adware.Virtumonde application


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads a malicious file
   • Drops files
   • Registry modification

 Files The following files are created:

– Non malicious files:
   • C:\%malware execution directory%\rt.ini
   • C:\%malware execution directory%\rt.ini2




It tries to download a file:

– The location is the following:
   • http://62.4.83.203/antispy/**********
It is saved on the local hard drive under: %TEMPDIR%\%eight-digit random character string%.dll Further investigation pointed out that this file is malware, too. Detected as: TR/Monder.XO

 Registry The following registry key is added in order to run the process after reboot:

– [HKCR\CLSID\{2C72B974-315C-439C-B13E-FB0E062D6B1C}\InprocServer32]
   • @="%malware execution directory%\%malware dll%"
   • "ThreadingModel"="Both"



It registers a browser helper object (BHO) by adding the following key:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
   Browser Helper Objects\
   • {2C72B974-315C-439C-B13E-FB0E062D6B1C}]

 File details Programming language:
 The malware program was written in MS Visual C++.

Description inserted by Thomas Wegele on Thursday, June 19, 2008
Description updated by Thomas Wegele on Thursday, June 19, 2008

Back . . . .