Trojan-Dropper.Win32.VB.me drops multiple copies of itself to saved download folders of known Peer-to-Peer applications.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Knowledge Base
Find the latest advice in our Community Knowledge Base.
User Guide
See the user guide for your product on the Help Center.
Submit a sample
Submit a file or URL for further analysis.
The malware's behavior primarily involves the use of peer-to-peer (P2P) applications. It initially checks for the existence of the following P2P configuration files and registry configuration to get the Directory where the downloaded files were kept:
It then queries the following P2P application executables and executes them if they exist:
By design, it will initially just check for a LimeWire installation. Checking for BearShare, Morpheus, Morpheus Ultra, and Shareaza will be done after checking if any of the following executables: bearshare.exe, morpheus.exe, or shareaza.exe are running in the processes. It then adds a hidden "_" folder in location where the default Saved folder is located. To continue, it first checks if it is running as %alluserstartup%\wmplayer.exe. If no, it generates a message box then exits:
If yes, it check to see if any of the following files exist in the system directory:
If the files are not found it drops and execute %windows%\b.exe. It locks the following system tools to prevent easy removal of the malware:
Attempt to execute the said tools prompts a message box:
It then drops a copy of itself as "yesyesyesyes.exe" to the saved directory of the target psp app inside the created "_" folder. It downloads the page:
It parses through file to get music or video titles, usually containing the most recent ones. Using these names it then creates a copy of itself on the saved download folders.
Date Created: -
Date Last Modified: -