TROJ_VB.AEB

This Trojan arrives either as a dropped file by other malware or as a file downloaded from the Internet by a user.

Upon execution, it searches for files with the following extensions:

• AVI
• JPG
• MP3
• MPG

When it finds a match, it drops a copy of itself using the file name of the found file appended with the extension .EXE. For example, if it finds a file PICTURE.JPG, it uses the file name PICTURE.JPG.EXE for its dropped copy.

It also modifies the last section of the dropped file in an attempt to avoid easy detection.

Furthermore, it creates a folder with an attribute set to Hidden using the file name without extension of the executed copy appended with the string 1 as the folder name.

Related Items