F-Secure
Tools
Trojan:W32/Monderd.gen
| Name : | Trojan:W32/Monderd.gen |
| Detection Names : |
Trojan.Win32.Monderd.gen Trojan.Generic.1715904, Trojan.Vundo.Gen.4 |
| Aliases : |
Trojan.Vundo (Symantec) Win32/Vundo (Microsoft) Vundo trojan (McAfee) |
| Category: | Malware |
| Type: | Trojan |
| Platform: | W32 |
Summary
A trojan, or trojan horse, is a seemingly legitimate program which secretly performs other, usually malicious, functions. It is usually user-initiated and does not replicate.
Additional Details
Trojan:W32/Monderd.gen is a generic detection for the Vundo trojan family.
While active, Vundo trojans displays pop-up advertisements. Some variants may also download and execute arbitrary files from remote sites.
The Vundo family is often distributed as DLL files. It is known to be bundled with adware and/or spyware programs.
Installation
Malware in the Vundo family are installed without the user's consent as a Browser Helper Objects (BHOs). During installation, the DLL file is dropped in Windows system directory. The file name is randomly generated using 8 alphabetic characters:
Upon execution, the DLL is injected into 2 running processes:
In some variants, several data files are created in the same location as the DLL file's execution. The data files' attributes are set as system file and hidden. The files use random names and the following extensions:
Activity
Once installed, the trojan modifies Microsoft Internet Explorer's security setting to trust cookie content created by the trojan:
Some variants may also attempt to download and execute arbitrary files from remote websites such as:
The program runs hidden from the user.
Registry
During installation, malware in the Vundo family create a registry launch point with a unique Class ID. This launch point automatically starts the DLL when system is restarted.
To find this launch point, navigate to the following registry and look for the malicious file pointed by "InprocServer32" registry key:
The program will also make further modifications to load itself at startup:
For some variants, the following registry keys are also created to load the program whenever the user logs on or off. The keys will use the same DLL file name as its key:
Impersonate=dword:00000000
Logon="o"
Logoff="f"
While active, Vundo trojans displays pop-up advertisements. Some variants may also download and execute arbitrary files from remote sites.
The Vundo family is often distributed as DLL files. It is known to be bundled with adware and/or spyware programs.
Installation
Malware in the Vundo family are installed without the user's consent as a Browser Helper Objects (BHOs). During installation, the DLL file is dropped in Windows system directory. The file name is randomly generated using 8 alphabetic characters:
• C:\WINDOWS\system32\{8_random_alpha_char}.dll
Upon execution, the DLL is injected into 2 running processes:
• Explorer.exe
• Winlogon.exe
In some variants, several data files are created in the same location as the DLL file's execution. The data files' attributes are set as system file and hidden. The files use random names and the following extensions:
• ini
• ini2
Activity
Once installed, the trojan modifies Microsoft Internet Explorer's security setting to trust cookie content created by the trojan:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{unique_CLSID}]
{unique_CLSID}]
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
{unique_CLSID}="malware_hex_value"Some variants may also attempt to download and execute arbitrary files from remote websites such as:
• http://childhe.com/[..]/apstpldr.dll.html
The program runs hidden from the user.
Registry
During installation, malware in the Vundo family create a registry launch point with a unique Class ID. This launch point automatically starts the DLL when system is restarted.
To find this launch point, navigate to the following registry and look for the malicious file pointed by "InprocServer32" registry key:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{unique_CLSID}\InprocServer32]
@="C:\WINDOWS\system32\{8_random_alpha_char}.dll"The program will also make further modifications to load itself at startup:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{unique_CLSID}For some variants, the following registry keys are also created to load the program whenever the user logs on or off. The keys will use the same DLL file name as its key:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{DLL_file_name}]
Asynchronous=dword:00000001 DllName="{DLL_file_name}" Impersonate=dword:00000000
Logon="o"
Logoff="f"