Description:
To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.
Malware Overview
This worm usually arrives via email. It can also be dropped by other malware.
It spreads by sending email messages containing a link, which redirect users to a malicious Web site where a copy of itself can be downloaded.
It uses its own Simple Mail Transfer Protocol (SMTP) engine to send the email. Having its own SMTP engine allows it to send messages without using any mailing application, such as Microsoft Outlook.
The email message this worm sends contains the following details:
Subject: (any of the following)
• Mrs. Clause Is Out Tonight!
• Find Some Christmas Tail
Message body: (any of the following)
• Hey man,
Good times and holiday sheer are good, but this is great. This will be the best 2 min you spend this holiday. hehe
http://{BLOCKED}rrychristmasdude.com
• got a sec?
Winter can be cold. I bet you could use a little something to warm you up. Take 2 min out of your day. You wont regret it. ;-)
http://{BLOCKED}rrychristmasdude.com/
The following is a screenshot of a sample spammed email:
This worm gathers target email addresses from files with certain file name extensions. However, it avoids sending email messages to addresses containing specific strings.
For additional information about this threat, see:
Solution
Technical Details
Description created: Dec. 25, 2007 12:43:57 PM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
