Email-Worm:W32/Mimail.P
Summary
Mimail.P worm was first found on 7th of January, 2004. The worm spreads in emails as a ZIP archive named PP-APP.ZIP that contains the worm's executable with a random name. The worm steals personal, and credit card information from users by asking them to fill a fake PayPal form. Also the worm steals email and news servers info, RAS info, passwords and email lists.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Installation to system
When the worm's file is run, it registers itself as a service process and becomes invisible in Task List on Windows 9x systems. The the worm copies itself as WINMGR32.EXE file to Windows directory and creates a startup key for this file in System Registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "WinMgr32" = "%windir%\winmgr32.exe"
where %windir% is Windows directory name.
After installation the worm looks for cookie files in shell folders and if it finds 'e-gold.com' string in any of them, it creates a special key in the Registry. This key is then checked when the worm activates its timer.
After initial startup the worm asks a userto fill a fake PayPal form. Information from that form is saved to a file and is sent to the worm's author. The form pages look like that:
The collected data is saved to a file named TMPENC.TXT that is located in the root of C: drive.
The worm drops the following files onto a hard disk:
- %windir%\zipzip.tmp - the worm's file inside a ZIP archive (store method)
- %windir%\ee98af.tmp - the worm's executable file copy
- c:\index.hta - fake Paypal form page 1
- c:\index2.hta - fake Paypal form pages 2 and 3
- c:\tmpny3.txt - information collected from the fake webform
- c:\tmpcan3.txt - empty file
where %windir%\ is a Windows directory.
The worm starts its main 3 threads only if it can resolve 'www.google.com' address i.e. when connection to Internet is available.
One of the worm's threads creates a file named TMPENC.TXT and saves the contents of TMPNY3.TXT file into it in encrypted form. Then the following files are deleted:
c:\index.hta c:\index2.hta c:\tmpny3.txt c:\tmpcan3.txt
Finally the encrypted contents of the webform (TMPENC.TXT file) are sent by email to an email address that is hardcoded in the worm's body. The same data is also uploaded to the www.aquarium-fish.ru website. After that the TMPENC.TXT file is deleted.
Being active, the worm listens to port 5555 for incoming traffic. When there's an incoming traffic, the worm creates a thread and communicates with the traffic source.
Spreading in emails
The worm spreads itself in emails inside a ZIP archive called PP-APP.ZIP. The worm's file inside that archive has a random name and EXE extension. The message sent by the worm looks like that:
From: donotreply@paypal.com Subject: GREAT NEW YEAR OFFER FROM PAYPAL.COM! [some random characters] Body: Dear PayPal.com Member, We here at PayPal.com are pleased to announce that we have a special New Year offer for you! If you currently have an account with PayPal then you will be eligible to receive a terrific prize from PayPal.com for the New Year. For a limited time only PayPal is offering to add 10% of the total balance in your PayPal account to your account and all you have to do is register yourself within the next five business days with our application (see attachment)! If at this time you do not have a PayPal account of your own you can also register yourself with our secure application and get this great New Year bonus! If you fill out the secure form we have provided PayPal will create an account for you (it's free) and you will receive a confirmation email that your account has been created. That's not all! If you resend this letter (with its attachment) to all of your friends you may be eligible to receive another New Year bonus because the 1000 PayPal members that send the most of these to their friends will get the bonus. If you are one of these 1000 lucky members then PayPal will add 17% of your total balance to your account! Registration is simple. Just unpack the attachment with WinZip, run the application, and follow the instructions we have provided. If you have problems opening the application then you may want to try downloading a free version of WinZip from www.winzip.com Do not miss your chance at this fantastic opportunity! Thousands of our current customers have already received their prizes and now it's your turn; so hurry up and take advantage of this special offer! Best of luck in the New Year, PayPal.com Team Attachment: pp-app.zip
The worm does not use any exploits to make its file start automatically on a recipient's system. The worm will infect a recipient's computer only when he/she unpacks the executable file from the archive and runs it.
To collect victim's email addresses the worm scans all files on a hard drive except those with the following extensions:
bmp jpg gif exe dll avi mpg mp3 vxd ocx psd tif zip rar pdf cab wav com
The collected email addresses are saved into OUTLOOK.CFG file located in Windows folder.
To send emails the worm tries to contact the recipient's SMTP server directly. For this purpose it tries to resolve the current user's DNS server and search for SMTP server info for recipient's domain.
Payload
The worm changes the startup page of Internet Explorer to point to a JPG image related to George Bush.
Also the worm has the code similar to the one used in Sysbug spying trojan. The worm collects the following information from an infected computer:
Account Name POP3 Password2 POP3 Server POP3 User Name NNTP Server NNTP User Name SMTP Server SMTP Display Name SMTP Email Address SMTP Organization Name RAS Information INETCOMM Server Passwords
This data is saved to a file called TMPPSW.TXT and this file sent by email to an email address that is hardcoded in the worm's body. The same data is also uploaded to the www.aquarium-fish.ru website.
Additionally the worm tries to upload the list of collected emails that it stores in the TMPEML.TXT file to the www.aquarium-fish.ru website. The emails stored in this file are specially selected by the worm. The selection criterion is the presence of one of the following substrings in email address:
.ca .au .uk .us .edu .gov .mil .de .it .ru .fr .info .org .net .com @email.msn.com @prodigy.net @safemail.net@excite.com @zwallet.com @erols.com @bigpond.com @usa.net @bigfoot.com @bellsouth.net @attglobal.net @att.net @attbi.com @email.it @lycos.com @sbcglobal.net @shaw.ca @themail.com @verizon.net @yahoo.com @msn.com @mail.com @hotmail.com @earthlink.net @aol.com
Beside stealing user's data from a fake PayPal webform, the worm also attempts to steal information from E-Gold online payment system users. It collects certain data to a file named TMPEG2.TXT that is located in the root of C: drive. The worm then encrypts this file and saves the contents to TMPGLD.TXT file. Then this file is sent by email to an email address that is hardcoded in the worm's body.
It should be noted, that every time the worm sends out stolen data, it tries to connect to the www.aquarium-fish.ru website and access different PHP scripts there. In some cases the worm can download and run executable file from that website. The file is downloaded as C:\MM.EXE and activated.