Trojan:Win32/Vundo.IG is a generic detection for a multi-component family of programs that deliver 'out of context' pop-up advertisements to the computer on which they are installed and may download and execute arbitrary files. Win32/Vundo.IG may exist on a computer as a dynamic link library (DLL) or as an executable. Some variants function as Browser Helper Objects (BHOs). It may also use defensive methods to make itself difficult to remove from the affected machine.
Installation
When Trojan:Win32/Vundo.IG is installed, it may be dropped with a randomly generated file name and executed via RUNDLL32.EXE. The trojan creates the following mutexes during its installation:
awx_mutant
Local_VMMainMutex
_ConsprMutx
Trojan:Win32/Vundo.IG makes the following registry modifications:
Adds value: @
With data: "<MALWARE>"
To subkey: HKCR\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}\InprocServer32
Adds value: ThreadingModel
With value: "Both"
To subkey: HKCR\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}\InprocServer32
Adds value: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
Adds value: <MALWARE FILENAME>
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
Adds value: Asynchronous
With value: dword:00000001
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\<MALWARE FILENAME>
Adds value: DllName
With value: <MALWARE FILENAME>
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\<MALWARE FILENAME>
Adds value: Impersonate
With value: dword:00000000
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\<MALWARE FILENAME>
Adds value: Logon
With value: "Logon"
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\<MALWARE FILENAME>
Adds value: Logoff
With value: "Logoff"
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\<MALWARE FILENAME>
Trojan:Win32/Vundo.IG injects itself to the following processes:
WINLOGON.EXE
EXPLORER.EXE
Payload
Downloads and Executes Arbitrary Files
This trojan injects its code into winlogon.exe and explorer.exe running processes, and creates remote threads in each. Win32/Vundo may connect to remote hosts using HTTP. This trojan may attempt to download additional malware onto the infected computer.
Terminates Processes
Vundo may terminate the processes "AD-AWARE.EXE" or "GCASSERVALERT.EXE" if they are running in memory.
Additional Information
Analysis by Huzefa Mogri