12/17: Atak.J Worm Uses Own Engine

12/17: Atak.J Worm Uses Own Engine
December 17, 2004

W32/Atak.j@MM is another variant of the Atak worm family. It bears the following characteristics:

harvests email addresses from the victim machine

spoofs the From: address

constructs messages using its own SMTP engine

When run, the worm installs itself into the Windows system directory as SEC5DEC.EXE, for example:

C:\WINDOWS\SYSTEM32\SEC5DEC.EXE

The following Registry key is added to hook system startup:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion \Windows "run" = C:\WINDOWS\SYSTEM32\SEC5DEC.EXE

The worm creates a mutex on the victim machine with the following name:

251204

More information can be found at McAfee page.