Home > Threat descriptions >

Mimail.S

Classification

Category: Malware

Type: Email-Worm

Aliases: Mimail.S, W32/Mimail.S@mm, I-Worm.Mimail.s

Summary


Mimail.S belongs to the Mimail mass-mailing worm family. It was first found on 29th of January, 2004. Like previous versions, the worm attempts to steal credit card information from users by asking them to fill a fake Microsoft registration form.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


System Infection

When the worm's file is run, it registers itself as a service process and becomes invisible in Task List on Windows 9x systems.

The the worm copies itself as "rabbit.exe" file to Windows directory and creates a startup key for this file in System Registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"RabbitWannaHome" = "%windir%\rabbit.exe"
 

where %windir% is Windows directory name.

Another copy is placed to the Windows Directory with the name 'x' which is used later when the worm sends itself in infected emails.

The worm activates the following functions only if it can resolve 'www.google.com' address i.e. when connection to Internet is available.

email Propagation

When spreading through email this variant of the worm composes email form a list of text strings within its body.

The name of the attachment is composed as follows, the first part of the filename is chosen from:

my
priv
private
prv
the
best
super
great
cool
wild
s*x
f*ck
 

With a separator selected from:

_ (underscore)
- (dash)
__ (double underscore)
 

Followed by a second word, form the list:

pic
img
phot
photos
pctrs
images
imgs
scene
plp
act
action
 

The extension of the attachment if chosen from the following list:

.pif
.scr
.exe
.jpg.scr
.jpg.pif
.jpg.exe
.gif.exe
.gif.pif
.gif.scr
 

To collect victim's email addresses the worm scans all files on a hard drive except those with the following extensions:

bmp
jpg
gif
exe
dll
avi
mpg
mp3
vxd
ocx
psd
tif
zip
rar
pdf
cab
wav
com
 

The collected email addresses are saved into "outlook.cfg" file located in Windows folder.

To send emails the worm tries to contact the recipient's SMTP server directly. For this purpose it tries to resolve the current user's DNS server and search for SMTP server info for recipient's domain.

Payload

After startup the worm asks the user to fill a fake Microsoft registration form. Information from that form is saved to a file and is sent to the worm's author.

The collected data is saved to a file named "xx" that is located in the root of C: drive. After the user has entered the credit card information Mimail.S sends it to predefined email addresses.