WORM_MARIOFEV.B

This worm arrives as attachment to mass-mailed email messages. It may be downloaded from remote sites by other malware. It may be dropped by other malware. It may be installed manually by a user. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself. It drops files/components.

It creates registry key(s)/entry(ies) as part of its installation routine.

It gathers target email addresses from cached email messages, address books, and mail boxes. It uses gathered or generated email addresses to spoof the From field of the email message it sends out.

It connects to a certain Web site to send and receive information.

It creates mutex(es) to ensure that only one instance of itself is running in memory.

Related Items