Tuesday, 17 December 2013
Worm:W32/Mydoom
Technical DetailsMydoom is a worm that spreads over email and the Kazaa Peer-to-Peer (P2P)network.When executed, the worm opens up Windows' Notepad with garbage data in it. When spreading, the infectious e-mail used to distribute the worm copies use variable subjects, bodies and attachment names.The worm encrypts most of the strings in it's UPX-packed body with ROT13 method, i.e. the characters are rotated 13 locations to the right in the abecedary, starting from the beginning if the position is beyond the last letter.Mydoom also performs a Distributed Denial-of-Service attack on www.sco.com. This attack starts on 1st of February.The worm opens up a backdoor to infected computers. This is done by planting a new SHIMGAPI.DLL file to system32 directory and launching it as a child process of EXPLORER.EXE.Mydoom is programmed to stop spreading on February 12th.For information on the B variant of Mydoom, see: http://www.f-secure.com/v-descs/mydoom_b.shtml
MyDoom.a_Code
work
bin2c.c
cleanpe.cpp
crypt1.c
rot13.c
stub.exe
xproxy
client.c
makefile
xproxy.c
_Main_Dir_
_readme.txt
lib.c
lib.h
main.c
makefile
massmail.c
massmail.h
msg.c
msg.h
p2p.c
resource.ico
resource.rc
scan.c
scan.h
sco.c
sco.h
xdns.c
xdns.h
xsmtp.c
xsmtp.h
zipstore.c
zipstore.h
30 Files \\ 2 Folders
Activity:
The worm will launch a Notepad window with garbage contents.
(SOMETIME IT WANT PASSWORD)
Password: R-Hacker
Subscribe to:
S.D.S (R-Hacker)
