|
|
I-Worm.Mimail. Viruses Information
| Name: |
I-Worm.Mimail. |
| Category: |
Viruses |
| Description:
|
Details
I-Worm.Mimail.c
Mimail.c, also known as I-Worm.WatchNet is the latest version of a potent Internet worm that spreads via the Internet in the form of a file attachment named photos.jpg.zip sent via email. Mimail is a Windows application file (PE EXE file) with a size of about 12KB compressed by UPX. The uncompressed size is about 27KB.
Infected email messages include the following content:
Sender address:
james@recipient domain
Subject:
Re[2]: our private photos
Body Text:
Hello Dear!,
Finally i've found possibility to right u, my lovely girl :)
All our photos which i've made at the beach (even when u're without ur bh:))
photos are great! This evening i'll come and we'll make the best SEX :)
Right now enjoy the photos.
Kiss, James.
Attachement:
photos.jpg.zip
(actual name is "photos.jpg.exe")
The Mimail.c worm only gains control if a victim opens the file attachment.
Reproduction
Mimail writes its into the Windows directory under the name netwatch.exe and then registers itself in the auto-run key file in the system registry:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
NetWatch32 = %windir%netwatch.exe
Mimail also creates the following files in the Windows directory:
exe.tmp
zip.tmp - a Zip archive of the worm (the compression method is 'stored')
eml.tmp - list of email addresses detected on infected (victim) computers
To create the ZIP archive the Mimail.c worm uses its own procedure that is built into its own code.
Spreading
To mail out infected messages (of itself), Mimail.c uses its own SMTP engine. To detect email addresses to target, the worm searches for address strings in files located in the Shell Folders and Program Files directories.
Other Information
Mimail.c watches for activity from the e-gold payment system (http://www.e-gold.com) application. If this application is detected, Mimail.c records some specific data from it in the file c:tmpe.tmp. This file is sent out to four email addresses belonging to the worm's author.
Mimail.c executes a DDoS attack against the web sitew www.darkprofits.com and www.darkprofits.net by sending to them an endless cycle of packets of random sizes. |
Top Viruses Visited Pages:
Invader. - 241 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 67 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
DARV.102
Accept.361
I-Worm.Lovelorn.
Nines.70
Bowl.73
Falco
Trojan.Win32.Revop.
Win95.Jacky.144
Sandy.103
SMEG.Pathoge
|
|
