Email-Worm:W32/Mimail.Q

Classification

Category :

Malware

Type :

Email-Worm

Aliases :

Mimail.Q, I-Worm.Mimail.q

Summary

Mimail.Q worm was first found on 26th of January, 2004. As with previous versions, the worm steals personal, and credit card information from users by asking them to fill a fake Microsoft form.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

The worm is wrapped in a polymorphic envelope, executables containing the worm will be different every time the worm spreads.

System Infection

When the worm's file is run, it registers itself as a service process and becomes invisible in Task List on Windows 9x systems. The the worm copies itself as "Sys32.exe" and "outlook.exe" file to Windows directory and creates a startup key for this file in System Registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"System" = "%windir%\sys32.exe"
 

where %windir% is Windows directory name.

After installation the worm looks for cookie files in shell folders and if it finds 'e-gold.com' string in any of them, it creates a special key in the Registry.

After initial startup the worm asks a user to fill a fake Microsoft form. Information from that form is saved to a file and is sent to the worm's author. The form pages look like that:

The collected data is saved to a file named "mminfo.txt" that is located in the root of C: drive.

The worm drops the following files onto a hard disk:

  • c:\mshome.hta - fake Microsoft form page
  • c:\logobig.gif - picture shown in the form page
  • c:\wind.gif - picture shown in the form page

The worm starts its main 3 threads only if it can resolve 'www.google.com' address i.e. when connection to Internet is available.

The worm listens to port 3000 for incoming traffic. When there's an incoming traffic, the worm creates a pipe and runs 'cmd.exe', giving the attacker a command line into the infected computer.

email propagation spreading

The worm was seeded in messages with the following format:

Subject: Hi my sweet Nancy! Body: Hi my sweet Nancy, 			 I have been thinking about you all night...
I would like to apologize for the other night when we made beautiful love and
did not use condoms.
I know.. this was a mistake and I beg you to forgive me..
Nancy, I miss you more than anything, please call me, I need you...
Do you remember when we were having wild sex in my house? I remember it all
like it was only yesterday.
You said that the photos would not come out good, but you were wrong, they are
great.
I didn't want to show you the pictures at first, but.. now I think it's time
for you to see them.
Please look in the attachment and you will see what I mean.

I love you with all my heart,
Frank

Attachment: photos.scr 			

When spreading by itself, this variant of the worm composes email form a selection of text strings within its body.

The name of the attachment is composed as follows, the first part of the filename is chosen from:

my
priv
private
prv
the
best
super
great
cool
wild
sex
fuck
 

With a separator selected from:

_ (underscore)
- (dash)
__ (double underscore)
 

Followed by a second word, form the list:

pic
img
phot
photos
pctrs
images
imgs
scene
plp
act
action
 

The extension of the attachment if chosen from the following list:

.pif
.scr
.exe
.jpg.scr
.jpg.pif
.jpg.exe
.gif.exe
.gif.pif
.gif.scr
 

To collect victim's email addresses the worm scans all files on a hard drive except those with the following extensions:

bmp
jpg
gif
exe
dll
avi
mpg
mp3
vxd
ocx
psd
tif
zip
rar
pdf
cab
wav
com
 

The collected email addresses are saved into "outlook.cfg" file located in Windows folder.

To send emails the worm tries to contact the recipient's SMTP server directly. For this purpose it tries to resolve the current user's DNS server and search for SMTP server info for recipient's domain.

Payload

Beside stealing user's data from a fake Microsoft webform, the worm also attempts to steal information from E-Gold online payment system users. It collects certain data to a file named TMPEG2.TXT that is located in the root of C: drive. The worm then encrypts this file and saves the contents to TMPGLD.TXT file. Then this file is sent by email to an email address that is hardcoded in the worm's body.

The worm contains the immature threat within its body:

*** GLOBAL WARNING: if any free email company or hosting company will
close/filter my emai l/site accounts, it will be DDoS'ed in next version.
WARNING: centrum.cz will be DDoS'ed in next versions, coz they have closed my
mimail-email account. Who next? ***

visit our friendly site www.blackgate.us 			

F-Secure is not aware of any possible relationship between "www.blackgate.us" and the creators of the worm.