PWS:Win32/VB.CU is a trojan that steals certain information from the affected computer. It also stops the SharedAccess service and overwrites certain files.
Installation
PWS:Win32/VB.CU drops a copy of itself as the following:
- <system folder>\explorer.exe
-
%windir%\spoolsv.exe
-
%windir%\svchost.exe
Note that these processes are not legitimate Windows applications; these are commonly used by malware files to disguise themselves as legitimate. The legitimate Windows applications are found in the following:
- <system folder>\spoolsv.exe
- <system folder>\svchost.exe
-
%windir%\explorer.exe
Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.
Upon execution, PWS:Win32/VB.CU adds the following registry key as part of its installation routine:
In subkey:
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}
or
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}
Sets value: "StubPath"
With data: "%AppData%\mrsys.exe MR"
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Sets value: "Explorer"
With data: "<system folder>\explorer.exe RO"
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Sets value: "Svchost"
With data: "%windir%\svchost.exe RO"
It also modifies the the following registry key so that its copy automatically runs every time Windows starts:
In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Sets value: "Shell"
With data: "%windir%\explorer.exe, <system folder>\explorer.exe"
PWS:Win32/VB.CU also creates a scheduled job to activate its dropped copy. The scheduled job file is saved as "%windir%\task\At1.job".
Payload
Disables network services
PWS:Win32/VB.CU disables the SharedAccess service which is responsible for the systems network connection activity.
Steals sensitive information
This password stealer logs clicks, keystrokes and window titles. It also collects the following information:
- email configuration (user name, password, email recipients, SMTP server, server port, authentication status, whether it is using SSL)
- instant messenger credentials
- downloaded files
- websites visited
- search keywords
- operating system
- Internet browser and version
- software installed in the system
- clipboard contents
- desktop captures
- network shared resources connected to the computer
Overwrites files
PWS:Win32/VB.CU overwrites executable files found in the same folder in which it was initially executed.
Additional information
PWS:Win32/VB.CU enables and starts the Schedule service to make sure the created scheduled job executes its dropped copy every day. To prevent its detection in the affected computer, it terminates its own processes.
Analysis by Zarestel Ferrer
