Beater
Beater | |
---|---|
Type | Mass mailer worm |
Creator | |
Date Discovered | 2005 |
Place of Origin | Saxony, Germany |
Source Language | |
Platform | MS Windows |
File Type(s) | .exe |
Infection Length | 12,288 bytes |
Beater is an email worm coded by DiA.
When the worm arrives, it comes in a German-language email. The subject line and message body will be a moderately enticing request to look at some pictures and weblinks. The attachment is named "Hot Lebian Picture Set.exe".
When executed, Beater displays an error message saying it can't find a specific file. The worm copies itself to the system folder as btr.exe. The worm modifies a registry key to ensure it runs every time Outlook or the Task Manager is run.
Beater gets a list of email addresses in the Outlook address book. It uses MAPI to send itself to all these addresses.
Sources
Sophos Antivirus, W32/Bater-A.
Trend Micro Antivirus, WORM_BATER.A.