Alias:EPOC.Cabir
Type:Worm 
Size:~ 
Origin:unknown 
Date:06-15-2004 
Damage: 
VDF Version:6.25.00.96 
Danger:Low 
Distribution:Low 

DistributionThe worm searches the area for mobile phones that have receive-activated Bluetooth and tries to send itself to them. If the receipt is confirmed, the worm runs and starts the bellow mentioned routines.

Technical DetailsWorm/Symbi.Cabir.A is the first known mobile phone worm. However, it can not spread, without the user confirming the receipt. The worm can spread on 60-series Nokia Smartphones, operating on "Symbian" system. It sends itself as installation file (.SIS) to all near equipment and tries to copy itself in "APPS" folder.

The following files are made:

* \SYSTEM\APPS\CARIBE\CARIBE.APP
* \SYSTEM\APPS\CARIBE\CARIBE.RSC
* \SYSTEM\APPS\CARIBE\FLO.MDL
* \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ CARIBE.APP
* \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ CARIBE.RSC
* \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ CARIBE.SIS
* \SYSTEM\RECOGS\FLO.MDL
* \SYSTEM\INSTALLS\CARIBE.SIS

Finally, the worm tries to send itself to all mobiles in the area, which have their Bluetooth reception activated. Anyway, the user must confirm the receipt. The worm is presently classified as Proof-of-Concept and is not a subject of serious spreading.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .