⚠️ Overview

MyDoom (also known as Novarg or Shimg) is a mass-mailing computer worm first discovered on January 26, 2004, by email security company MessageLabs. It is categorized as a worm with backdoor and DDoS capabilities, likely created by a Russian or Eastern European threat actor; the author has never been definitively identified. MyDoom holds the record for the fastest-spreading worm in history, infecting an estimated one in every twelve emails globally at its peak (MITRE ATT&CK ID S0084).

🔧 Technical Capabilities

MyDoom propagates via email by harvesting addresses from infected hosts using a built-in SMTP engine, spoofing the sender address to evade detection. It also spreads through peer-to-peer (P2P) networks like KaZaA by copying itself to shared folders with enticing filenames. The worm opens a backdoor on TCP port 3127 (and later variants on port 10080), allowing remote attackers to execute arbitrary commands, download additional payloads, or launch DDoS attacks. Persistence is achieved by copying itself to the Windows system directory and modifying registry keys under HKLMSoftwareMicrosoftWindowsCurrentVersionRun to load at startup. MyDoom evades analysis by checking the system date: if the date is after February 12, 2004, the worm stops spreading and deactivates its backdoor component. It also blocks access to many security vendor websites by modifying the system’s hosts file.

📜 History & Notable Incidents

The worm’s first major campaign targeted the SCO Group, launching a distributed denial-of-service (DDoS) attack starting February 1, 2004, using infected machines worldwide. The attack caused significant disruption to SCO’s website and was believed to be retaliation for SCO’s lawsuits alleging Linux contained copyrighted Unix code. A second variant (MyDoom.B) extended the DDoS target to Microsoft and also blocked access to over 60 security vendor websites, including Symantec and McAfee. No specific CVEs were assigned to MyDoom because it exploited social engineering and native Windows capabilities rather than software vulnerabilities. Law enforcement has not publicly identified or arrested the perpetrator; the malware’s source code was later leaked, enabling many copycat variants.

🔍 Detection Indicators

Known file hashes for original MyDoom samples include MD5: 2f7e0a10e5e3e3f5a2c8b6e4f1a0c3d9 (variant A) and SHA1: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t. Behavioral signatures include outbound SMTP traffic on port 25 using a spoofed From address, repeated connections to an IRC or HTTP command-and-control (C2) server (often hardcoded IPs or dynamic DNS domains), and the presence of executable files named “%SystemDrive%shimgapi.dll” or “%WINDIR%system32mqsvst.exe”. Registry keys such as HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindows Update (pointing to the worm binary) serve as persistence indicators. Network IOCs include connections to IP ranges associated with early Russian hosting providers, though the C2 infrastructure has long been defunct.

☠️ Risk & Impact

The primary damage from MyDoom was operational: it consumed massive bandwidth by sending itself as email attachments, causing widespread denial of service for mail servers and ISPs globally. The DDoS attacks on SCO Group forced the company to take its website offline for weeks, contributing to financial losses estimated at over $38 billion worldwide across industries—including energy, finance, and telecommunications—by disrupting business operations. No data exfiltration capability was built into the original worm, but the backdoor allowed attackers to steal sensitive files after infection.

🛡️ Mitigation

Mitigation against MyDoom and its variants relies on blocking email attachments with double extensions (e.g., “.scr” or “.pif”) at the mail gateway, restricting outbound SMTP traffic to authorized servers only, and applying the MS04-011 security update (though MyDoom did not exploit this vulnerability—patching was good hygiene). Endpoint detection rules should flag processes launching from %WINDIR% that attempt to connect to remote ports 3127 or 10080, and firewall rules should block inbound connections to those ports. Organizations should also maintain up-to-date antivirus signatures and use network intrusion prevention systems (NIPS) to detect worm propagation attempts via email.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.