SirCam is mass-mailing worm with a sophisticated means of propagation: its own email engine. Although SirCam (w32.Sircam@mm) is not known to have dangerous payload, this worm does have the ability to spread quickly and could shut down email servers with excess traffic.
How it works
SirCam arrives as an email message with the following information in either English or Spanish:
Subject: (Random)
Body: (Random content--see below)
Attached: (Random)
The body of the email will always begin with "Hi! How are you?" and end with "See you later. Thanks." In between these opening and closing lines will be one of the following:
- I send you this file in order to have your advice
- I hope you can help me with this file that I send
- I hope you like the file that I send you
- This is the file with the information that you ask for
SirCam can also spread among open file shares on a networked system (in other words, if you can access other directories on other machines, that's an open file share).
If a user clicks on the attached file, SirCam will copy itself to the Windows System directory with the name scam32.exe. The worm changes the Windows registry key so that it always launches upon system startup. The worm will check to see if there are any open shares on a network and if so, SirCam will copy rundll32.exe to the system, renaming the existing rundll32.exe to run32.exe.
SirCam contains its own Simple Mail Transfer Protocol (SMTP) (similar to Magistr). SirCam has its own email program that it uses to read addresses from Windows address books as well as temporary Internet folders. It then sends copies of itself to those addresses.
