➔
search
✕

TROJ_PLUGX.SFI

August 07, 2015
 Analysis by: RonJay Kristoffer Caragay
 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW


This Trojan arrives as a component bundled with malware/grayware packages.

It is a component of other malware.

It does not have any propagation routine.

  TECHNICAL DETAILS

File Size:

115,297 bytes

File Type:

None

Memory Resident:

Yes

Initial Samples Received Date:

30 Jul 2015

Arrival Details

This Trojan arrives as a component bundled with malware/grayware packages.

Installation

This Trojan is a component of other malware.

Propagation

This Trojan does not have any propagation routine.

Other Details

This Trojan requires the following additional components to properly run:

  • {malware path}\MpClient.dll

NOTES:

This Trojan is an encrypted component file that contains binary code upon decryption.

The file {malware path}\MpClient.dll, detected as BKDR_PLUGX.SFI, is used to decrypt and load TROJ_PLUGX.SFI.

It does not have rootkit capabilities.

It does not exploit any vulnerability.

  SOLUTION

Minimum Scan Engine:

9.750

FIRST VSAPI PATTERN FILE:

11.822.05

FIRST VSAPI PATTERN DATE:

30 Jul 2015

VSAPI OPR PATTERN File:

11.823.00

VSAPI OPR PATTERN Date:

31 Jul 2015

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Remove the malware/grayware file dropped/downloaded by TROJ_PLUGX.SFI. (Note: Please skip this step if the threat(s) listed below have already been removed.)

Step 3

Scan your computer with your Trend Micro product to delete files detected as TROJ_PLUGX.SFI. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.