Description:
To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.
Malware Overview
This worm arrives as an attachment to email messages spammed by another malware or a malicious user. It may also be downloaded from certain Web sites that purport to be related to Barack Obama. These said Web sites appear like the following Web page:
It propagates by searching for email addresses in files found in fixed, network, and RAM drives, avoiding files with certain extension names. The harvested email addresses are first encrypted and stored in a file with a random name before sending them to certain IP addresses.
It opens random ports to listen for commands from a remote user, thus, compromising the affected system.
For additional information about this threat, see:
Solution
Technical Details
Description created: Jan. 20, 2009 6:47:15 AM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
