F-Secure Virus Descriptions : Mimail.G
[Summary] | [Detailed Description]
|
|
THIS VIRUS IS RANKED AS LEVEL 2 ALERT UNDER
F-SECURE RADAR.
Radar Alert LEVEL 2
|
Mimail.G worm was found on 2nd of November, 2003. It is a close
variant of Mimail.C worm. The description of Mimail.C worm
variant can be found here:
http://www.europe.f-secure.com/v-descs/mimail_c.shtml
The Mimail.G worm is a minor variant of Mimail.C worm. The
differences between these 2 versions are as follows:
1. The Mimail.G worm's file is 10784 bytes long, compressed with
UPX file compressor, the unpacked file's size is 22560 bytes.
2. The worm installs itself to Windows folder as SYSLOAD32.EXE
file and creates a startup key in the Registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"SystemLoad32" = "%windir\sysload32.exe"
where %windir% is a Windows directory name.
3. The worm performs a DoS (Denial of Service) attack on the
following sites:
mysupersales.com
www.mysupersales.com
4. The worm spreads itself in the following message:
From:
john@<domain of the recipient>
Subject:
don't be late! <some random characters>
Body:
Will meet tonight as we agreed, because on Wednesday I don't think I'll make it,
so don't be late. And yes, by the way here is the file you asked for.
It's all written there. See you.
<some random characters>
Attachment:
readnow.zip
The attachment is a ZIP archive that contains the worm's
executable file with READNOW.DOC.SCR name.
5. The .G worm variant doesn't have the spying functionality that
was present in the .C worm variant.
Detection
Detection in F-Secure Anti-Virus was published on November 3rd,
2003 in the following updates:
[FSAV_Database_Version]
Version=2003-11-03_01
Technical Details:
Alexey Podrezov, November 3rd, 2003;
F-Secure Corporation
|
