Worm/Symbi.Cabir.A - Worm

Vedi anche

Descrizione completa

Alias:	EPOC.Cabir
Type:	Worm
Size:	~
Origin:	unknown
Date:	06-15-2004
Damage:
VDF Version:	6.25.00.96 - Tue, 15 Jun 2004 16:07 (GMT+1)
Danger:	Low
Distribution:	Low

DistributionThe worm searches the area for mobile phones that have receive-activated Bluetooth and tries to send itself to them. If the receipt is confirmed, the worm runs and starts the bellow mentioned routines.

Technical DetailsWorm/Symbi.Cabir.A is the first known mobile phone worm. However, it can not spread, without the user confirming the receipt. The worm can spread on 60-series Nokia Smartphones, operating on "Symbian" system. It sends itself as installation file (.SIS) to all near equipment and tries to copy itself in "APPS" folder.

The following files are made:

* \SYSTEM\APPS\CARIBE\CARIBE.APP
* \SYSTEM\APPS\CARIBE\CARIBE.RSC
* \SYSTEM\APPS\CARIBE\FLO.MDL
* \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ CARIBE.APP
* \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ CARIBE.RSC
* \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ CARIBE.SIS
* \SYSTEM\RECOGS\FLO.MDL
* \SYSTEM\INSTALLS\CARIBE.SIS

Finally, the worm tries to send itself to all mobiles in the area, which have their Bluetooth reception activated. Anyway, the user must confirm the receipt. The worm is presently classified as Proof-of-Concept and is not a subject of serious spreading.

Per la descrizione "in breve" clicca qui.

Descrizione inserita da Crony Walker il Tue, 15 Jun 2004 14:00 (GMT+1)

» Informazioni sul malware
» Informazioni sul phishing
» Viruses In the Wild

« Indietro