Home / malware Trojan-Dropper:W32/VB.ME
First posted on 25 June 2008.
Source: SecurityHomeAliases :
There are no other names known for Trojan-Dropper:W32/VB.ME.
Explanation :
Trojan-Dropper.Win32.VB.me drops multiple copies of itself to saved download folders of known Peer-to-Peer applications.
right]The malware's behavior primarily involves the use of peer-to-peer (P2P) applications.
It initially checks for the existence of the following P2P configuration files and registry configuration to get the Directory where the downloaded files were kept:
- %appdata%LimeWire.limewire.props
- %appdata%morpheusmorphconfig.ini
- %appdata%morpheus ultramorphconfig.ini
- %programfiles%BearShareFreePeers.ini
It then queries the following P2P application executables and executes them if they exist:
- %programfiles%limewirelimewire.exe
- %programfiles%shareazashareaza.exe
- %programfiles%earshareearshare.exe
- %programfiles%morpheusmorpheus.exe
- %programfiles%morpheus ultramorpheus.exe
By design, it will initially just check for a LimeWire installation. Checking for BearShare, Morpheus, Morpheus Ultra, and Shareaza will be done after checking if any of the following executables: bearshare.exe, morpheus.exe, or shareaza.exe are running in the processes.
It then adds a hidden "_" folder in location where the default Saved folder is located.
To continue, it first checks if it is running as %alluserstartup%wmplayer.exe.
If no, it generates a message box then exits:
- "Windows Media Player"
"Media player cannot play file codec is missing"
If yes, it check to see if any of the following files exist in the system directory:
- winlog.exe
- p2pnetworking.exe
- scvhost.exe
- winlogi.exe
- p2pnetwork.exe
- csrrs.exe
If the files are not found it drops and execute %windows%.exe.
It locks the following system tools to prevent easy removal of the malware:
- %system%cmd.exe
- %system%
etstat.exe- %system% racert.exe
- %system%ping.exe
- %system%ipconfig.exe
- %system% askkill.exe
- %system%
egedt32.exe- %system% askmgr.exe
- %windows%
egedit.exe
Attempt to execute the said tools prompts a message box:
- [appname]
"Another program is currently using this file"
It then drops a copy of itself as "yesyesyesyes.exe" to the saved directory of the target psp app inside the created "_" folder.
It downloads the page:
- http://www.mp3000.net[REMOVED]ads/page[randomdigit]-mp3.php
It parses through file to get music or video titles, usually containing the most recent ones. Using these names it then creates a copy of itself on the saved download folders.Last update 25 June 2008
