Threat Description

Trojan-Dropper:​W32/VB.ME

Details

Aliases: Trojan-Dropper:​W32/VB.ME, Trojan-Dropper.Win32.VB.me
Category: Malware
Type: Trojan-Dropper
Platform: W32

Summary



Trojan-Dropper.Win32.VB.me drops multiple copies of itself to saved download folders of known Peer-to-Peer applications.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



The malware's behavior primarily involves the use of peer-to-peer (P2P) applications. It initially checks for the existence of the following P2P configuration files and registry configuration to get the Directory where the downloaded files were kept:

  • %appdata%\LimeWire\.limewire.props
  • %appdata%\morpheus\morphconfig.ini
  • %appdata%\morpheus ultra\morphconfig.ini
  • %programfiles%\BearShare\FreePeers.ini

It then queries the following P2P application executables and executes them if they exist:

  • %programfiles%\limewire\limewire.exe
  • %programfiles%\shareaza\shareaza.exe
  • %programfiles%\bearshare\bearshare.exe
  • %programfiles%\morpheus\morpheus.exe
  • %programfiles%\morpheus ultra\morpheus.exe

By design, it will initially just check for a LimeWire installation. Checking for BearShare, Morpheus, Morpheus Ultra, and Shareaza will be done after checking if any of the following executables: bearshare.exe, morpheus.exe, or shareaza.exe are running in the processes. It then adds a hidden "_" folder in location where the default Saved folder is located. To continue, it first checks if it is running as %alluserstartup%\wmplayer.exe. If no, it generates a message box then exits:

  • "Windows Media Player" "Media player cannot play file codec is missing"

If yes, it check to see if any of the following files exist in the system directory:

  • winlog.exe
  • p2pnetworking.exe
  • scvhost.exe
  • winlogi.exe
  • p2pnetwork.exe
  • csrrs.exe

If the files are not found it drops and execute %windows%\b.exe. It locks the following system tools to prevent easy removal of the malware:

  • %system%\cmd.exe
  • %system%\netstat.exe
  • %system%\tracert.exe
  • %system%\ping.exe
  • %system%\ipconfig.exe
  • %system%\taskkill.exe
  • %system%\regedt32.exe
  • %system%\taskmgr.exe
  • %windows%\regedit.exe

Attempt to execute the said tools prompts a message box:

  • [appname] "Another program is currently using this file"

It then drops a copy of itself as "yesyesyesyes.exe" to the saved directory of the target psp app inside the created "_" folder. It downloads the page:

  • http://www.mp3000.net[REMOVED]ads/page[randomdigit]-mp3.php

It parses through file to get music or video titles, usually containing the most recent ones. Using these names it then creates a copy of itself on the saved download folders.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More