F-Secure Virus Descriptions : Mimail.P
[Summary] | [Detection]
|
|
|
| NAME: | Mimail.P |
| ALIAS: | I-Worm.Mimail.p, W32/Mimail.P@mm, Mimail.P |
Mimail.P worm was first found on 7th of January, 2004. The worm
spreads in e-mails as a ZIP archive named PP-APP.ZIP that
contains the worm's executable with a random name. The worm
steals personal, and credit card information from users by asking
them to fill a fake PayPal form. Also the worm steals e-mail and
news servers info, RAS info, passwords and e-mail lists.
Installation to system
When the worm's file is run, it registers itself as a service
process and becomes invisible in Task List on Windows 9x systems.
The the worm copies itself as WINMGR32.EXE file to Windows
directory and creates a startup key for this file in System
Registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"WinMgr32" = "%windir%\winmgr32.exe"
where %windir% is Windows directory name.
After installation the worm looks for cookie files in shell
folders and if it finds 'e-gold.com' string in any of them, it
creates a special key in the Registry. This key is then checked
when the worm activates its timer.
After initial startup the worm asks a userto fill a fake PayPal
form. Information from that form is saved to a file and is sent
to the worm's author. The form pages look like that:
The collected data is saved to a file named TMPENC.TXT that is
located in the root of C: drive.
The worm drops the following files onto a hard disk:
%windir%\zipzip.tmp - the worm's file inside a ZIP archive (store method)
%windir%\ee98af.tmp - the worm's executable file copy
c:\index.hta - fake Paypal form page 1
c:\index2.hta - fake Paypal form pages 2 and 3
c:\tmpny3.txt - information collected from the fake webform
c:\tmpcan3.txt - empty file
where %windir%\ is a Windows directory.
The worm starts its main 3 threads only if it can resolve
'www.google.com' address i.e. when connection to Internet is
available.
One of the worm's threads creates a file named TMPENC.TXT and
saves the contents of TMPNY3.TXT file into it in encrypted form.
Then the following files are deleted:
c:\index.hta
c:\index2.hta
c:\tmpny3.txt
c:\tmpcan3.txt
Finally the encrypted contents of the webform (TMPENC.TXT file)
are sent by e-mail to an e-mail address that is hardcoded in the
worm's body. The same data is also uploaded to the
www.aquarium-fish.ru website. After that the TMPENC.TXT file is
deleted.
Being active, the worm listens to port 5555 for incoming traffic.
When there's an incoming traffic, the worm creates a thread and
communicates with the traffic source.
Spreading in e-mails
The worm spreads itself in e-mails inside a ZIP archive called
PP-APP.ZIP. The worm's file inside that archive has a random name
and EXE extension. The message sent by the worm looks like that:
From:
donotreply@paypal.com
Subject:
GREAT NEW YEAR OFFER FROM PAYPAL.COM! <some random characters>
Body:
Dear PayPal.com Member,
We here at PayPal.com are pleased to announce that we have a
special New Year offer for you! If you currently have an account
with PayPal then you will be eligible to receive a terrific
prize from PayPal.com for the New Year. For a limited time only
PayPal is offering to add 10% of the total balance in your
PayPal account to your account and all you have to do is
register yourself within the next five business days with our
application (see attachment)!
If at this time you do not have a PayPal account of your own you
can also register yourself with our secure application and get
this great New Year bonus! If you fill out the secure form we
have provided PayPal will create an account for you (it's free)
and you will receive a confirmation e-mail that your account has
been created.
That's not all! If you resend this letter (with its attachment)
to all of your friends you may be eligible to receive another
New Year bonus because the 1000 PayPal members that send the
most of these to their friends will get the bonus. If you are
one of these 1000 lucky members then PayPal will add 17% of your
total balance to your account!
Registration is simple. Just unpack the attachment with WinZip,
run the application, and follow the instructions we have
provided. If you have problems opening the application then you
may want to try downloading a free version of WinZip from
www.winzip.com
Do not miss your chance at this fantastic opportunity!
Thousands of our current customers have already received their
prizes and now it's your turn; so hurry up and take advantage of
this special offer!
Best of luck in the New Year,
PayPal.com Team
Attachment:
pp-app.zip
The worm does not use any exploits to make its file start
automatically on a recipient's system. The worm will infect a
recipient's computer only when he/she unpacks the executable file
from the archive and runs it.
To collect victim's e-mail addresses the worm scans all files on
a hard drive except those with the following extensions:
bmp
jpg
gif
exe
dll
avi
mpg
mp3
vxd
ocx
psd
tif
zip
rar
pdf
cab
wav
com
The collected e-mail addresses are saved into OUTLOOK.CFG file
located in Windows folder.
To send e-mails the worm tries to contact the recipient's SMTP
server directly. For this purpose it tries to resolve the current
user's DNS server and search for SMTP server info for recipient's
domain.
Payload
The worm changes the startup page of Internet Explorer to point
to a JPG image related to George Bush.
Also the worm has the code similar to the one used in Sysbug
spying trojan. The worm collects the following information from
an infected computer:
Account Name
POP3 Password2
POP3 Server
POP3 User Name
NNTP Server
NNTP User Name
SMTP Server
SMTP Display Name
SMTP Email Address
SMTP Organization Name
RAS Information
INETCOMM Server Passwords
This data is saved to a file called TMPPSW.TXT and this file sent
by e-mail to an e-mail address that is hardcoded in the worm's
body. The same data is also uploaded to the www.aquarium-fish.ru
website.
Additionally the worm tries to upload the list of collected
e-mails that it stores in the TMPEML.TXT file to the
www.aquarium-fish.ru website. The e-mails stored in this file are
specially selected by the worm. The selection criterion is the
presence of one of the following substrings in e-mail address:
.ca
.au
.uk
.us
.edu
.gov
.mil
.de
.it
.ru
.fr
.info
.org
.net
.com
@email.msn.com
@prodigy.net
@safe-mail.net@excite.com
@zwallet.com
@erols.com
@bigpond.com
@usa.net
@bigfoot.com
@bellsouth.net
@attglobal.net
@att.net
@attbi.com
@email.it
@lycos.com
@sbcglobal.net
@shaw.ca
@themail.com
@verizon.net
@yahoo.com
@msn.com
@mail.com
@hotmail.com
@earthlink.net
@aol.com
Beside stealing user's data from a fake PayPal webform, the worm
also attempts to steal information from E-Gold online payment
system users. It collects certain data to a file named TMPEG2.TXT
that is located in the root of C: drive. The worm then encrypts
this file and saves the contents to TMPGLD.TXT file. Then this
file is sent by e-mail to an e-mail address that is hardcoded in
the worm's body.
It should be noted, that every time the worm sends out stolen
data, it tries to connect to the www.aquarium-fish.ru website and
access different PHP scripts there. In some cases the worm can
download and run executable file from that website. The file
is downloaded as C:\MM.EXE and activated.
Detection for Mimail.P is available in the following FSAV
updates:
[FSAV_Database_Version]
Version=2004-01-07_02
Technical Details:
Alexey Podrezov; January 7th, 2004;
Description Updated:
Alexey Podrezov; January 8th, 2004;
F-Secure Corporation
|
