W32/Mytob-DI is a mass-mailing worm and IRC backdoor Trojan for the Windows platform.
W32/Mytob-DI runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
When first run W32/Mytob-DI copies itself to the Windows system folder as m0use.exe and creates the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Userinterface Report3r
m0use.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Userinterface Report3r
m0use.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Userinterface Report3r
m0use.exe
W32/Mytob-DI also changes the following registry entries:
from:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe
to:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe m0use.exe
The pathname of m0use.exe is also appended to the 'shell=' line in the [boot] section of <Windows>\System.ini, so that it is run on startup.
W32/Mytob-DI also disables certain system processes including the Windows XP firewall by changing the following default registry entry:
from:
HKLM\System\CurrentControlSet\Services\SharedAccess
Start
3
to:
HKLM\System\CurrentControlSet\Services\SharedAccess
Start
4
W32/Mytob-DI also includes functionality to silently download, install and run new software.
W32/Mytob-DI modifies the HOSTS file, changing the URL-to-IP mappings for selected websites, therefore preventing normal access to these sites. The new HOSTS file will typically contain the following:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 pandasoftware.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
127.0.0.1 www.amazon.com
127.0.0.1 www.amazon.co.uk
127.0.0.1 www.amazon.ca
127.0.0.1 www.amazon.fr
127.0.0.1 www.paypal.com
127.0.0.1 paypal.com
127.0.0.1 moneybookers.com
127.0.0.1 www.moneybookers.com
127.0.0.1 www.ebay.com
127.0.0.1 ebay.com
W32/Mytob-DI is capable of spreading through email. Email sent by W32/Mytob-DI has the following properties:
Subject line chosen from:
'Notice of account limitation'
'Email Account Suspension'
'Security measures'
'Members Support'
'Important Notification'
'Warning Message: Your services near to be closed.'
'Your Account is Suspended For Security Reasons'
'*DETECTED* Online User Violation'
'Your Account is Suspended'
'Your new account password is approved'
'You have successfully updated your password'
'Your password has been successfully updated'
'Your password has been updated'
<random characters>
There is no message text enclosed within the email.
The attached file consists of any of the following base names followed by the extension ZIP:
'account-report'
'readme'
'account-info'
'email-details'
'account-details'
'important-details'
'accepted-password'
'account-password'
'approved-password'
'password'
'new-password'
'email-password'
'updated-password'
'document'
<random characters>
The worm may optionally create double extensions where the first extension is DOC, TXT or HTM and the final extension is PIF, SCR, EXE or ZIP.
W32/Mytob-DI harvests email addresses from files on the infected computer and from the Windows address book.