Worm:Win32/Prolaco.T

Installation

Spreads via…

• The file specified in this registry entry:
  HKCU\Software\Microsoft\WAB\WAB4\Wab File Name
  
• The following directories under %userprofile%
  Temporary Internet Files
  Local Settings
  
• All non RAMDISK drives from C: to Y:

• Email from Address can be one of the following:

• e-cards@hallmark.com'
• invitations@twitter.com
• invitations@hi5.com
• order-update@amazon.com
• resume-thanks@google.com
• update@facebookmail.com

• Email Subject can be one of the following:

• You have received A Hallmark E-Card!
• Your friend invited you to Twitter!
• Cindy would like to be your friend on hi5!
• Shipping update for your Amazon.com order
• Thank you from Google!
• You have got a new message on Facebook!

• Email Body can contain the following text:

• You have received A Hallmark E-Card.
  Hello!
  You have received a Hallmark E-Card from y our friend.
  To see it, check the attachment.
  There's something special about that E-Card feeling. We invite you to make a friend's day and send one.
  
  Hope to see you soon,
  Your friends at Hallmark

• Your friend invited you to twitter!
  Twitter is a service for friends, family, and co-workers to communicate and stay connected through the exchange of quick, frequent answers to one simple question:
  What are you doing?
  To join or to see who invited you, check the attachment.

• Meet new people and keep up with friends on hi5.
  Cindy would like to be your friend on hi5!
  I set up a hi5 profile and I want to add you as a friend so we can share pictures and starjt building our network. First see your invitation card I attached! Once you join, you will have a chance to create a profile, share pictures, and find friends.

• Shipping update for your Amazon.com order
  Please check the attachment and confirm your shipping details.

• Gmail - Thank you from Google!
  We just received your resume and would like to thank you for your interest in working at Google. This email confirms that your application has been submitted for an open position.
  Our staffing team will carefully assess your qualifications for the role(s) you<br /> selected and others that may be a fit. Should there be a suitable match, we will be sure to get in touch with you.
  Click on the attached file to review your submitted application.
  Have fun and thanks again for applying to Google!
  Google Staffing

• Facebook
  You have got a personal message on Facebook from your friend.
  To read it please check the attachment.
  Thanks,
  The Facebook Team

• Postcard
• Invitation Card
• Shipping documents
• Facebook message

Payload