|
Description:
To get a one glance comprehensive view of the behavior of this worm, refer to the Behavior Diagram shown below.
Malware Description
This Trojan may arrive on an affected system as an attachment of an email message. Upon execution, it drops and executes a copy of itself in the Windows folder. The dropped file uses any of various predetermined file names. It then modifies the system registry to ensure its automatic execution at every system startup.
This Trojan then checks certain registry keys to obtain valuable information, such as user names and the Simple Mail Transfer Protocol (SMTP) servers used by the affected system.
It arrives via an email that uses the London bombing incident to trick users into opening and executing this Trojan.
The email has the following details:
Subject:
TERROR HITS LONDON
From:
"CNN Newsletter" {breakingnews@cnnonline.com}
Message body:
{A modified HTML copy of the CNN web page regarding the London Bombing}
Attachment:
LondonTerrorMovie.zip
(containing the following file)
London Terror Moovie.avi - multiple spaces
Checked By Norton Antivirus.exe
Below is a screenshot of the email:
This Trojan also has the capacity to send out unsolicited email messages in bulk.
This Trojan generates email addresses by using certain strings appended with a domain name.
For additional information about this threat, see:
Solution
Technical Details
Description created: Jul. 9, 2005 5:27:10 AM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
