Threat Description

Mimail.S

Details

Aliases: Mimail.S, W32/Mimail.S@mm, I-Worm.Mimail.s
Category: Malware
Type: Email-Worm
Platform: W32

Summary



Mimail.S belongs to the Mimail mass-mailing worm family. It was first found on 29th of January, 2004. Like previous versions, the worm attempts to steal credit card information from users by asking them to fill a fake Microsoft registration form.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



System Infection

When the worm's file is run, it registers itself as a service process and becomes invisible in Task List on Windows 9x systems.

The the worm copies itself as "rabbit.exe" file to Windows directory and creates a startup key for this file in System Registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 "RabbitWannaHome" = "%windir%\rabbit.exe"
 

where %windir% is Windows directory name.

Another copy is placed to the Windows Directory with the name 'x' which is used later when the worm sends itself in infected emails.

The worm activates the following functions only if it can resolve 'www.google.com' address i.e. when connection to Internet is available.

E-Mail Propagation

When spreading through email this variant of the worm composes e-mail form a list of text strings within its body.

The name of the attachment is composed as follows, the first part of the filename is chosen from:

my
 priv
 private
 prv
 the
 best
 super
 great
 cool
 wild
 s*x
 f*ck
 

With a separator selected from:

_ (underscore)
 - (dash)
 __ (double underscore)
 

Followed by a second word, form the list:

pic
 img
 phot
 photos
 pctrs
 images
 imgs
 scene
 plp
 act
 action
 

The extension of the attachment if chosen from the following list:

.pif
 .scr
 .exe
 .jpg.scr
 .jpg.pif
 .jpg.exe
 .gif.exe
 .gif.pif
 .gif.scr
 

To collect victim's e-mail addresses the worm scans all files on a hard drive except those with the following extensions:

bmp
 jpg
 gif
 exe
 dll
 avi
 mpg
 mp3
 vxd
 ocx
 psd
 tif
 zip
 rar
 pdf
 cab
 wav
 com
 

The collected e-mail addresses are saved into "outlook.cfg" file located in Windows folder.

To send e-mails the worm tries to contact the recipient's SMTP server directly. For this purpose it tries to resolve the current user's DNS server and search for SMTP server info for recipient's domain.

Payload

After startup the worm asks the user to fill a fake Microsoft registration form. Information from that form is saved to a file and is sent to the worm's author.

The collected data is saved to a file named "xx" that is located in the root of C: drive. After the user has entered the credit card information Mimail.S sends it to predefined email addresses.



Detection


Detection for Mimail.S is available in the following FSAV updates:
Detection Type: PC
Database: 2004-01-29_01



Technical Details: Gergely Erdelyi and Ero Carrera; January 29th, 2004


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Disinfect your PC

F-Secure Anti-Virus will disinfect your PC and remove all harmful files

Learn More