Email-Worm

An Email-Worm (also known as a mass-mailer or less commonly, an Internet worm) is a type of worm that distributes copies of itself in an infectious executable files attached to fake email messages.

For representative examples of email-worms, see:

• Email-Worm:W32/Waledac.A
• Email-Worm:MSIL/Agent.MXK
• Email-Worm:W32/Brontok.N

Distribution

Email-Worm typically arrive as executable files attached to fake email messages.

Some mass mailers randomly compose the subjects and bodies of the messages from words and phrases carried in the worm's own code; other worms use content found in randomly selected files in the infected computer to compose the message. The name of the file attachment can be either random, or 'borrowed' from other files.

Many worms send themselves as attachments with double extension, for example .MPG.EXE or AVI.PIF. Often, a recipient will only notice the first extension listed and will try to open such attachments thinking, that they are multimedia files.

Execution

Email-worms normally use social engineering tactics to entice the user into opening and executing the email attachment. As such, users can avoid infection by an email-worm by simply refusing to open any email file attachments without first verifying its safety with the email sender.

In some cases however, an infected attachment may contain an exploit that allows the email worm to install and start automatically on the computer, without any user action. This is only possible if the email client contains certain vulnerabilities.

Payload

Most worms nowadays include malicious routines (e.g., password or data stealing) or carry viruses and backdoors that they can install on a victim's machine.