--2004年1月7日更新情報 --
・W32/Mimail.p@MMは、以下のメディアの注目を集めたので、危険度を“低〔要注意〕”にしました。
・W32/Mimail.p@MMは大量メール送信型ワーム（MSVCで作成）で、W32/Mimail@MMの新しい亜種です。AVERTはUPXで圧縮されたものと圧縮されていないものとの両方のサンプルを受信しました。
・AVERTの初期の分析では、W32/Mimail.p@MMは以下の性質を持っています。
- 自身のSMTPエンジンを使用してメッセージを作成し、ターゲットマシンから収集したターゲット電子メールに送信します。
- 送信メッセージにこのワームがZIPファイル（PP-APP.ZIP）形式で添付されます。このメッセージは信者をだましてPayPalから送信されたものだと思わせるように作成されています。
- ターゲットの詳細（クレジットカード番号など）はターゲットマシンから収集されます（W32/Mimail.j@MMと類似）。
電子メールを介した繁殖
・W32/Mimail.p@MMは感染したコンピュータで検出されたアドレスに自身を電子メールで送信します。送信先アドレスはターゲットマシンのファイルから収集されます。これまでの亜種については、ターゲットフォルダは以下のレジストリキーをクエリすることで決定されます。
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
・AVERTの分析では、W32/Mimail.p@MMが電子メール送信を介して自身を複製することの確認は継続中です。
送信者：GREAT NEW YEAR OFFER FROM PAYPAL.COM!
添付ファイル：PP-APP.ZIP (ランダムにEXEの文字が含まれたファイル名)
本文：
*** GREAT NEW YEAR OFFER FROM PAYPAL.COM *** Dear PayPal.com Member,
We here at PayPal.com are pleased to announce that we have a special New Year offer for you!
If you currently have an account with PayPal then you will be eligible to receive a terrific prize from PayPal.com for the New Year. For a limited time only PayPal is offering to add 10% of the total balance in your PayPal account to your account and all you have to do is register yourself within the next five business days with our application (see attachment)!
If at this time you do not have a PayPal account of your own you can also register yourself with our secure application and get this great New Year bonus! If you fill out the secure form we have provided PayPal will create an account for you (it's free) and you will receive a confirmation e-mail that your account has been created.
That's not all! If you resend this letter (with its attachment) to all of your friends you may be eligible to receive another New Year bonus because the 1000 PayPal members that send the most of these to their friends will get the bonus. If you are one of these 1000 lucky members then PayPal will add 17% of your total balance to your account!
Registration is simple. Just unpack the attachment with WinZip, run the application, and follow the instructions we have provided. If you have problems opening the application then you may want to try downloading a free version of WinZip from http://www.winzip.com
Do not miss your chance at this fantastic opportunity! Thousands of our current customers have already received their prizes and now it's your turn; so hurry up and take advantage of this special offer!
Best of luck in the New Year,
PayPal.com Team
Dear PayPal.com Member,
We here at PayPal.com are pleased to announce that we have a special New Year offer for you!
If you currently have an account with PayPal then you will be eligible to receive a terrific prize from PayPal.com for the New Year. For a limited time only PayPal is offering to add 10% of the total balance in your PayPal account to your account and all you have to do is register yourself within the next five business days with our application (see attachment)!
If at this time you do not have a PayPal account of your own you can also register yourself with our secure application and get this great New Year bonus! If you fill out the secure form we have provided PayPal will create an account for you (it's free) and you will receive a confirmation e-mail that your account has been created.
That's not all! If you resend this letter (with its attachment) to all of your friends you may be eligible to receive another New Year bonus because the 1000 PayPal members that send the most of these to their friends will get the bonus. If you are one of these 1000 lucky members then PayPal will add 17% of your total balance to your account!
Registration is simple. Just unpack the attachment with WinZip, run the application, and follow the instructions we have provided. If you have problems opening the application then you may want to try downloading a free version of WinZip from http://www.winzip.com
Do not miss your chance at this fantastic opportunity! Thousands of our current customers have already received their prizes and now it's your turn; so hurry up and take advantage of this special offer!
Best of luck in the New Year,
PayPal.com Team
Dear PayPal.com Member,
We here at PayPal.com are pleased to announce that we have a special New Year offer for you!
If you currently have an account with PayPal then you will be eligible to receive a terrific prize from PayPal.com for the New Year. For a limited time only PayPal is offering to add 10% of the total balance in your PayPal account to your account and all you have to do is register yourself within the next five business days with our application (see attachment)!
If at this time you do not have a PayPal account of your own you can also register yourself with our secure application and get this great New Year bonus! If you fill out the secure form we have provided PayPal will create an account for you (it's free) and you will receive a confirmation e-mail that your account has been created.
That's not all! If you resend this letter (with its attachment) to all of your friends you may be eligible to receive another New Year bonus because the 1000 PayPal members that send the most of these to their friends will get the bonus. If you are one of these 1000 lucky members then PayPal will add 17% of your total balance to your account!
Registration is simple. Just unpack the attachment with WinZip, run the application, and follow the instructions we have provided. If you have problems opening the application then you may want to try downloading a free version of WinZip from http://www.winzip.com
Do not miss your chance at this fantastic opportunity! Thousands of our current customers have already received their prizes and now it's your turn; so hurry up and take advantage of this special offer!
Best of luck in the New Year,
PayPal.com Team
PayPalスキャン
・W32/Mimail.p@MMが実行されると、以下のウィンドウが表示されます。
・このフォームが完了すると、データが以下のファイルに書き込まれます。
・次に、以下のウィンドウが表示されます。
・このフォームのデータは以下のファイルに暗号化されて書き込まれます。
・最後に、確認画面が表示されます。
情報詐取
・PayPalスキャンのターゲットは、自身のクレジットカード情報を上記のCドライブのルートにあるファイルと照合します。
・TMPNY3.TXTにはクレジットカードの詳細が含まれています。AVERTの初期の分析では、電子メールを介してW32/Mimail.p@MMにハードコート化された電子メールアドレスに送信されます。
・TMPENC.TXTにはDOB、アドレスなどの情報（暗号化済み）が含まれています。このデータはHTTPを介して通知され、リモートPHPスクリプトによって処理されます。
・ほかのデータ（RASの詳細、パスワード、e-goldの情報−現在分析中）もターゲットマシンから収集されます。HTTPを介して通知され、リモートPHPスクリプトによって処理されます。
