WORM_ZHELATI.BHA

This worm arrives as attachment to email messages spammed by another malware or a malicious user. It can also be dropped by other malware.

Upon execution, this worm drops a copy of itself. It then creates a registry entry to enable its automatic execution at every system startup.

This worm propagates by sending email messages containing a link, which redirect users to a malicious Web site where a copy of itself can be downloaded.

It uses its own Simple Mail Transfer Protocol (SMTP) engine to send the email. Having its own SMTP engine allows it to send messages without using any mailing application, such as Microsoft Outlook.

This worm gathers target email addresses from files with certain file name extensions. However, it avoids sending email messages to addresses containing certain strings.

Related Items