SonicALERT
Search

Sonicwall Signatures

 

Go to All Categories list.


  Mytob.EQ@mm
Mytob.EQ@mm is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. Mytob.EQ@mm is compressed using the UPX executable packer and its file size is 40,448 bytes. It also changes Windows registry:
  • Creates value "default"="" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
  • Creates value "default"="" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices".
It creates the following mutex to ensure only one instance is running: H-E-L-L-B-O-T-P-O-L-Y-M-O-R-P-H. It also attempts to acquire the "SeDebugPrivilege" privileges, monitors the list of running processes, is executed every time Windows starts.


Relevant Information