WORM_NUWAR.ARI

To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.

Malware Overview

This worm spreads by sending email messages, which contain a link that point to a remote copy of itself, using its own Simple Mail Transfer Protocol (SMTP) engine. Clicking on the said link downloads and executes a copy of this worm named HALLOWEEN.EXE. The said action also directs users to a site named Dancing Skeleton, as shown below:

This worm gathers target email addresses from files with the specific file name extensions. It then uses the Gmail and Yahoo! Mail addresses that it gathers to spoof the From field of the email message it sends out. Moreover, it downloads the message body it uses from certain URLs.

This worm drops several files, including a Trojan detected as TROJ_PEACOMM.GS. It also terminates certain processes, if found running in memory.

Related Items