Mimail.S belongs to the Mimail mass-mailing worm family. It was first
found on 29th of January, 2004. Like previous versions, the worm attempts
to steal credit card information from users by asking them to fill a fake
Microsoft registration form.
When the worm's file is run, it registers itself as a service process and
becomes invisible in Task List on Windows 9x systems.
The the worm copies itself as "rabbit.exe" file to Windows
directory and creates a startup key for this file in System Registry:
"RabbitWannaHome" = "%windir%\rabbit.exe"
where %windir% is Windows directory name.
Another copy is placed to the Windows Directory with the name 'x' which
is used later when the worm sends itself in infected emails.
The worm activates the following functions only if it can resolve
'www.google.com' address i.e. when connection to Internet is available.
When spreading through email this variant of the worm composes e-mail form a
list of text strings within its body.
The name of the attachment is composed as follows, the first part of the
filename is chosen from:
With a separator selected from:
__ (double underscore)
Followed by a second word, form the list:
The extension of the attachment if chosen from the following list:
To collect victim's e-mail addresses the worm scans all files on
a hard drive except those with the following extensions:
The collected e-mail addresses are saved into "outlook.cfg" file
located in Windows folder.
To send e-mails the worm tries to contact the recipient's SMTP
server directly. For this purpose it tries to resolve the current
user's DNS server and search for SMTP server info for recipient's
After startup the worm asks the user to fill a fake Microsoft
registration form. Information from that form is saved to a file
and is sent to the worm's author.
The collected data is saved to a file named "xx" that is
located in the root of C: drive. After the user has entered the
credit card information Mimail.S sends it to predefined email
Detection for Mimail.S is available in the following FSAV updates:
Gergely Erdelyi and Ero Carrera; January 29th, 2004;