W32/Mimail.M Worm

 Information about the W32/Mimail.M Worm:

W32/Mimail.M is an email worm. This worm is a variant of W32/Mimail.L worm. The worm spreads through email.

It arrives with the following subject:

Subject: Re:GREG

The 'From' email address of the infected email may vary within its list.

The body of the infected mail will be :

Hello Greg,

I was shocked, when I found out that it wasn't you but your
twin brother!!! That's amazing, you're as like as two peas. No
one in bed is better than you Greg. I remember,
I remember everything very well, that promised you to tell how it was,
I'll give you a call today after 9.

He took my skirt off, then my panties, then my bra, he sucked my tits,
with the same fury you do it. He was writing alphabet
on my pussy for 20 minutes, then suddenly stopped, put me in
doggy style position and stuck his dagger.But Greg, why didn't
you warn me that his dick is 15 inches long?? I was struck, we
fucked whole night.

I'm so thankful to you, for acquainted me to your brother. I
think we can do it on the next Saturday all three together?
What do you think? O yes, as you wanted I've made a few
pictures check them out in archive, I hope they will excite
you, and you will dream of our new meeting...

Wendy.


The infected mail carries an attachment, only_for_greg.zip.

Upon execution of infected attachment, the worm copies itself as netmon.exe in the Windows folder. The worm also copies nji2.tmp and msi2.tmp in Windows folder.

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm searches for the email addresses present in the infected system and stores them in a file called xjwu2.tmp, in the Windows folder. While hunting for email addresses, the worm ignores the files with the following extensions; .zip, .wav, .vxd, .tif, .rar, .psd, .pdf, .ocx, .mpg, .mp3, .jpg, .exe, .dll, .com, .cab, .bmp, .avi. The worm uses its own SMTP engine to mail itself to these email addresses.

It also attempts to perform a DDOS attack on the following websites:

darkprofits.cc
darkprofits.com
darkprofits.net
darkprofits.ws
www.darkprofits.cc
www.darkprofits.com
www.darkprofits.net
www.darkprofits.ws

This worm first appeared on 3rd December 2003.

 Other names of W32/Mimail.M Worm:

This worm is also known as W32.Mimail.M@mm , WORM_MIMAIL.M, W32/Mimail.m@MM.