Threat Description

Trojan-Dropper:​W32/VB.ME

Details

Aliases:Trojan-Dropper:​W32/VB.ME, Trojan-Dropper.Win32.VB.me
Category:Malware
Type:Trojan-Dropper
Platform:W32

Summary



Trojan-Dropper.Win32.VB.me drops multiple copies of itself to saved download folders of known Peer-to-Peer applications.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



The malware's behavior primarily involves the use of peer-to-peer (P2P) applications. It initially checks for the existence of the following P2P configuration files and registry configuration to get the Directory where the downloaded files were kept:

  • %appdata%\LimeWire\.limewire.props
  • %appdata%\morpheus\morphconfig.ini
  • %appdata%\morpheus ultra\morphconfig.ini
  • %programfiles%\BearShare\FreePeers.ini

It then queries the following P2P application executables and executes them if they exist:

  • %programfiles%\limewire\limewire.exe
  • %programfiles%\shareaza\shareaza.exe
  • %programfiles%\bearshare\bearshare.exe
  • %programfiles%\morpheus\morpheus.exe
  • %programfiles%\morpheus ultra\morpheus.exe

By design, it will initially just check for a LimeWire installation. Checking for BearShare, Morpheus, Morpheus Ultra, and Shareaza will be done after checking if any of the following executables: bearshare.exe, morpheus.exe, or shareaza.exe are running in the processes. It then adds a hidden "_" folder in location where the default Saved folder is located. To continue, it first checks if it is running as %alluserstartup%\wmplayer.exe. If no, it generates a message box then exits:

  • "Windows Media Player" "Media player cannot play file codec is missing"

If yes, it check to see if any of the following files exist in the system directory:

  • winlog.exe
  • p2pnetworking.exe
  • scvhost.exe
  • winlogi.exe
  • p2pnetwork.exe
  • csrrs.exe

If the files are not found it drops and execute %windows%\b.exe. It locks the following system tools to prevent easy removal of the malware:

  • %system%\cmd.exe
  • %system%\netstat.exe
  • %system%\tracert.exe
  • %system%\ping.exe
  • %system%\ipconfig.exe
  • %system%\taskkill.exe
  • %system%\regedt32.exe
  • %system%\taskmgr.exe
  • %windows%\regedit.exe

Attempt to execute the said tools prompts a message box:

  • [appname] "Another program is currently using this file"

It then drops a copy of itself as "yesyesyesyes.exe" to the saved directory of the target psp app inside the created "_" folder. It downloads the page:

  • http://www.mp3000.net[REMOVED]ads/page[randomdigit]-mp3.php

It parses through file to get music or video titles, usually containing the most recent ones. Using these names it then creates a copy of itself on the saved download folders.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More