Trojan-Dropper:W32/VB.ME

Classification

Malware

Trojan-Dropper

W32

Trojan-Dropper:W32/VB.ME, Trojan-Dropper.Win32.VB.me

Summary

Trojan-Dropper.Win32.VB.me drops multiple copies of itself to saved download folders of known Peer-to-Peer applications.

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

For more Support

Community

Find the latest advice in our Community.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

The malware's behavior primarily involves the use of peer-to-peer (P2P) applications. It initially checks for the existence of the following P2P configuration files and registry configuration to get the Directory where the downloaded files were kept:

  • %appdata%\LimeWire\.limewire.props
  • %appdata%\morpheus\morphconfig.ini
  • %appdata%\morpheus ultra\morphconfig.ini
  • %programfiles%\BearShare\FreePeers.ini

It then queries the following P2P application executables and executes them if they exist:

  • %programfiles%\limewire\limewire.exe
  • %programfiles%\shareaza\shareaza.exe
  • %programfiles%\bearshare\bearshare.exe
  • %programfiles%\morpheus\morpheus.exe
  • %programfiles%\morpheus ultra\morpheus.exe

By design, it will initially just check for a LimeWire installation. Checking for BearShare, Morpheus, Morpheus Ultra, and Shareaza will be done after checking if any of the following executables: bearshare.exe, morpheus.exe, or shareaza.exe are running in the processes. It then adds a hidden "_" folder in location where the default Saved folder is located. To continue, it first checks if it is running as %alluserstartup%\wmplayer.exe. If no, it generates a message box then exits:

  • "Windows Media Player" "Media player cannot play file codec is missing"

If yes, it check to see if any of the following files exist in the system directory:

  • winlog.exe
  • p2pnetworking.exe
  • scvhost.exe
  • winlogi.exe
  • p2pnetwork.exe
  • csrrs.exe

If the files are not found it drops and execute %windows%\b.exe. It locks the following system tools to prevent easy removal of the malware:

  • %system%\cmd.exe
  • %system%\netstat.exe
  • %system%\tracert.exe
  • %system%\ping.exe
  • %system%\ipconfig.exe
  • %system%\taskkill.exe
  • %system%\regedt32.exe
  • %system%\taskmgr.exe
  • %windows%\regedit.exe

Attempt to execute the said tools prompts a message box:

  • [appname] "Another program is currently using this file"

It then drops a copy of itself as "yesyesyesyes.exe" to the saved directory of the target psp app inside the created "_" folder. It downloads the page:

  • http://www.mp3000.net[REMOVED]ads/page[randomdigit]-mp3.php

It parses through file to get music or video titles, usually containing the most recent ones. Using these names it then creates a copy of itself on the saved download folders.