Threat Description

Mimail.T

Details

Aliases: Mimail.T, W32/Mimail.T@mm, I-Worm.Mimail.t
Category: Malware
Type: Email-Worm
Platform: W32

Summary


Mimail.T belongs to the Mimail mass-mailing worm family. It was first found on 5th of February, 2004.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details


System Infection

When the worm's file is run, it registers itself as a service process and becomes invisible in Task List on Windows 9x systems.

The the worm copies itself as "kaspersky.exe" file to Windows directory and creates a startup key for this file in System Registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]  "KasperskyAv" = "%windir%\kaspersky.exe"   

where %windir% is Windows directory name.

Another copy is placed to the Windows Directory with the name 'ee98af.tmp' which is used later when the worm sends itself in infected emails.

The worm activates the following functions only if it can resolve 'www.google.com' address i.e. when connection to Internet is available.

E-Mail Propagation

When spreading through email this variant of the worm composes e-mail form a list of text strings within its body.

The name of the attachment is composed as follows, the first part of the filename is chosen from:

my  priv  private  prv  the  best  super  great  cool  wild  s*x  f*ck   

Followed by a second word, form the list:

pic  img  phot  photos  pctrs  images  imgs  scene  plp  act  action   

The extension of the attachment if chosen from the following list:

.pif  .scr  .exe  .jpg.scr  .jpg.pif  .jpg.exe  .gif.exe  .gif.pif  .gif.scr   

To collect victim's e-mail addresses the worm scans all files on a hard drive except those with the following extensions:

bmp  jpg  gif  exe  dll  avi  mpg  mp3  vxd  ocx  psd  tif  zip  rar  pdf  cab  wav  com   

The collected e-mail addresses are saved into "outlook.cfg" file located in Windows folder.

To send e-mails the worm tries to contact the recipient's SMTP server directly. For this purpose it tries to resolve the current user's DNS server and search for SMTP server info for recipient's domain.





Technical Details:Gergely Erdelyi and Ero Carrera; February 5th, 2004


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More