W32/Mimail.S Worm

 Information about the W32/Mimail.S Worm:

W32/Mimail.S is a mass mailing worm. This worm is a variant of W32/Mimail worm. This worm has a capability of stealing the credit card information of the infected user. This worm spreads through email.

It arrives with the random subject. The subject is a combination of words randomly chosen by the worm.

The body of the infected mail will be random text chosen by the worm.

Example:

Hi <Random name>,

I wondered My sister had best sex last night with the mom of
<Random name> %_(
And I switched on my digital <brand name> camera and make some
good photos %_(
I beg you don't show it to your boss, okay?

It carries an infected attachment with combination of predefined filenames, along with combinations of the following extensions .exe, .pif, .jpg, .scr.

Upon execution of the attachment, the worm copies itself as rabbit.exe and X in the Windows folder. The worm also drops a HTML file ms.hta in the root of C drive, used to popup the fake Microsoft Licensing window.

In order to steal the credit card information, the worm bluffs the user by displaying a fake "Microsoft Windows" window requesting the user for his/her credit card number, pin and other secured information to update his/her Windows license. Once the information is completely entered and confirmed, the worm stores all the collected data in the XX folder created in the root of C drive. Later on it tries to send this file to a pre-configured email address.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm searches for the email addresses present in the infected computer. In this process email addresses present in the files with the following extensions are excluded: .mpg, .avi, .dll, .bmp, .com, .wav, .exe, .gif, .jpg, .cab, .pdf, .rar, .zip, .tif, .psd, .ocx, .vxd, .mp3 and store those email addresses in Outlook.cfg in the Windows folder. The worm uses its own SMTP engine to mail itself to these email addresses.

The worm also regularly tries to connect to "www.google.com", inorder to check the internet connectivity.

This worm first appeared on 29th January, 2004.

 Other names of W32/Mimail.S Worm:

This Worm is also known as W32/Mimail.S@MM, W32.Mimail-S, WORM_MIMAIL.S, Win32.Mimail.S.