1/12: Buchon-C a Mass-Mailing Worm

1/12: Buchon-C a Mass-Mailing Worm
January 12, 2005
W32/Buchon.c@MM is a mass-mailing worm. It bears the following characteristics:

contains its own SMTP engine to construct outgoing messages

harvests target email addresses from the victim machine

spoofs the From: address

drops a trojan (keylogging and proxy) to the victim machine

The worm harvests target email addresses from files on the victim machine with the following extensions:

.dbx

.wab

.mbx

.eml

.mdb

.tbb

.txt

.html

.htm

.doc

.rtf

.cgi

.php

.asp

.inbox

.dat

Outgoing messagees are constructed as follows:

From: Spoofed
Subject: Mail Delivery failure - (insert target email address)

More information can be found at McAfee page.