W32/Stration.A Worm

 Information about the W32/Stration.A Worm:

W32/Stration.A is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The 'Subject' of the infected mail will be any one of the following;

(Blank)
(Random)
hello
Error
Status
Good day
Server Report
Mail Delivery System

The body of the infected mail will be any one of the following;

Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary attachment.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment

The name of the infected attachment will be any one of the following;

(Random)
doc
body
data
text
file
readme
document

The extension of the infected attachment will be any of the following;

.bat
.cmd
.exe
.pif
.scr
.zip

Upon execution of the infected attachment, the worm copies itself as SVCHOST32.EXE in the Windows folder.

It also copies a non-malicious file with a random file name in the same folder where it was originally executed.

It drops several copies of itself in the Windows temporary folder as files with double extensions.

To propagate itself, the worm copies all available email address from Windows Address book(WAB) of the infected system.

The worm mails itself to these addresses using its own SMTP engine.

This worm first appeared on August 18, 2006.

 Other names of W32/Stration.A Worm:

This Worm is also known as W32.Stration.A@mm, WORM_STRATION.A .