Home / malware

PDF

Win32.Fbound.C@mm

First posted on 21 November 2011.
Source: BitDefender

Aliases :

Win32.Fbound.C@mm is also known as W32/Fbound.C.

Explanation :

It arrives in the following format:

Subject:
if the receiving e-mail address is not in a .jp domain): Important
if receiving e-mail address is a .jp domain: a Japanese subject randomly selected from 17 different subjects

Attachment: Patch.exe

After the user executes the attachment the worm searches for e-mail addresses in Outlook Express address book and send itself to those addresses in the same format it arrives. The worm uses the user SMTP settings for spreading itself.

Win32.Fbound.A@mm is a slightly different version of this worm. It has the same subjects and attachment but the code was more structured.

Last update 21 November 2011

 

TOP