Skip to content

Threat Encyclopedia
Export page to PDF
TROJ_PHINDOLP.A
Malware type: Trojan
Destructive: No
Platform: Windows 2000, Windows XP, Windows Server 2003
Encrypted: No
In the wild: Yes

Overview


Infection Channel: Dropped by other malware

This Trojan may be dropped by other malware.

It modifies the Internet Explorer Zone Settings.

Technical Details


File size: 53,248 bytes
File type: EXE
Memory resident: Yes
Initial samples received date: 03 Apr 2012
Payload: Steals information, Terminates processes

Arrival Details

This Trojan may be dropped by the following malware:

  • TROJ_DROPHIN.A

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
arun = "%User Temp%\explorer.exe"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
Enabled = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
ShownVerifyBalloon = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Recovery
AutoRecover = "2"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Check_Associations = "no"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
DisableFirstRunCustomize = "2"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
IEHardenIENoWarn = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnonZoneCrossing = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnOnPostRedirect = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap
IEharden = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
DEPOff = "1"

Web Browser Home Page and Search Page Modification

This Trojan modifies the Internet Explorer Zone Settings.

NOTES:

This Trojan checks if it is running under a virtual environment by querying the following registry key:

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Disk\Enum

It checks for the presence of the following strings on the aforementioned registry:

  • VBOX
  • Virtual
  • VMware

It terminates the following processes to make sure that only Firefox, Chrome, Opera, or Internet Explorer is the browser used by the affected user:

  • maxthon.exe
  • 360se.exe

It may then send the following parameter to its C&C server to report the running browser on the affected system:

  • ReuseFF
  • IEalone
  • ReuseOP

It retrieves the host name and domain of the affected machine by querying the following values on the following registry key:

  • Registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters

  • Registry values

・HostName
・Domain

It retrieves the IP address, default gateway, and DHCP IP address by querying the following values on the following registry key:

  • Registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

  • Registry values

・IPAddress
・DefaultGateway
・DHCPIPAddress

It checks for installed email clients by querying the following registry key:

HKEY_LOCAL_MACHINE\software\clients\mail

It checks for installed web browsers by querying the following registry key:

HKEY_LOCAL_MACHINE\Software\Classes\http\shell

It searches for the following strings on the aforementioned registry key:

  • FIREFOX.EXE
  • Chrome
  • Maxthon3
  • Opera
  • 360

It queries the following registry key to check the default browser in the system:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet

It obtains the Proxy Server, AutoConfigURL, and checks if Proxy is enabled on the affected machine by querying the following values in the following registry key:

  • Registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings

  • Registry values

・ProxyEnable
・ProxyServer
・AutoConfigURL

It checks the version of Internet Explorer by querying the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Version Vector

It then encrypts and sends all the gathered information above to the C&C server http://sky{BLOCKED}1.name/{.aspx directory}?r={encrypted information}&a= via HTTP POST.

Note that {.aspx directory} may be any of the following:

  • shfam9y/Default.aspx
  • shfam9y/Direct9.aspx
  • shfam9y/login0.aspx
  • shfam9y/www2.aspx

The server may then reply with a binary download which the malware then executes. As of this writing, the C&C does not have a response.

It copies %System%\cmd.exe as %User Temp%\~vmdmc.exe, which it uses to silently execute downloaded binaries.

It also queries the following registry entry to check if command prompt is enabled:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
DisableCMD

If disabled, it modifies the registry Value accordingly to make sure its download and execute routine will be successful.

It is capable of modifying browser preferences to adjust proxy configurations of the affected machines.

Solution


Minimum scan engine: 9.200
First VSAPI Pattern File: 8.888.03
First VSAPI Pattern Release Date: 05 Apr 2012
VSAPI OPR Pattern Version: 8.889.00
VSAPI OPR Pattern Release Date: 06 Apr 2012

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Remove malware/grayware files that dropped/downloaded TROJ_PHINDOLP.A

    TROJ_DROPHIN.A

Step 3

Identify and terminate files detected as TROJ_PHINDOLP.A

[ Learn more ]
  1. If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
  2. If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.

Step 4

Delete this registry value

[ Learn more ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.


  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter
    • Enabled = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter
    • ShownVerifyBalloon = "3"
  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery
    • AutoRecover = "2"
  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    • Check_Associations = "no"
  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    • DisableFirstRunCustomize = "2"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    • IEHardenIENoWarn = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    • WarnonZoneCrossing = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    • WarnOnPostRedirect = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
    • IEharden = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • arun = "%User Temp%\explorer.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
    • DEPOff = "1"

Step 5

Scan your computer with your Trend Micro product to delete files detected as TROJ_PHINDOLP.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.
Analysis By: Roland Marco Dela Paz

Connect with us on