Threat behavior
Win32/Mugly.H@mm is a mass mailing worm that spreads by sending a copy of itself as an attachment via e-mail and to contacts in MSN Messenger or Windows Messenger.
When Win32/Mugly.H@mm is run, it does the following:
- Drops files to the Windows system folder:
ANSMTP.DLL
uglym.jpg
xxz.tmp
attached.zip
svchosts.exe (detected as Win32/Spybot.BE)
bszip.dll
- Displays image using system's default picture viewer:
Win32/Mugly.H@mm modifies the registry in order to load when Windows is started:
Adds value: virtual-machine
With data: svchosts.exe
To subkeys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Win32/Mugly.H@mm sends itself using the following attachment names:
Pic_001.jpg
Sexy_09.jpg
Scan_04
Photo_01
admire_001.jpg
is_this_you.jpg.
love_04
for_you
The attachment extension may be .exe, .scr, or .pif.
The email composed by the Win32/Mugly.H@mm email may be spoofed using an email address discovered on the infected system or may use one of the following hard-coded addresses:
adead_poet@hotmail.com
alex_edwards2000@msn.com
romeorichard@google.com
apiffany@cnet.com
sexy_lil_thing@no-ip.com
cutie_pie@ogrish.com
easy_lay666@lovenet.com
hunk_hogan78@hallmark.com
britany_slut56@sex.com
tit_fuck_909@gmail.com
good_fuck12@yahoo.com
blowjob_lips666@romance.com
tit_fuck_909@paltalk.com
sexy_guy88@aol.com
mucle_bound_hunk892@download.com
The subject of the e-mail may be one of the following:
Hhahahah lol!!!!
Your Pic On A Website!!
You have an Admirer
Rate My Pic.......
Message body (one of the following:
- i found this on my computer from ages ago
download it and see if you can remember it
lol i was lauging like mad when i saw it! :D
email me back haha…
- I was looking at a website and came across
this pic they look just like you! infact im sure
it is lol , did you send this pic into them ? or
is it someonce else :S ? Ive Added the pic in
a zip so download it and check & email me back!
- Hi ive sent 5 emails now and nobody will rate
my pic!! :( please download and tell me what you
think out of 10 , dont worry if you dont like it
just say i wont be offended p.s i was drunk when
it was taken :P
- Someone has asked us on there behalf to send
you this email and tell you they think you are
wonderfull!!! All the The mystery persons details
you need are enclosed in the attachment :)
please download and respond telling us if you
would like to make further contact with this
person.
Prevention