427 Botnet fm qxd

www.syngress.com
Common Botnets • Chapter 4
125
427_Bot_ch04.qxt 1/9/07 3:03 PM Page 125

---

W
ARNING
Mytob sends itself out using its own SMTP engine, but it attempts to
guess the recipient mail server to make the malware e-mail more con-
vincing. Mytob will try to use any of the following with the target
domain name to guess the right mail server: mx, mail, smtp, mx1, mxs,
mail1, relay, or ns.
Table 4.10
File Extensions Known to Be Commonly Targeted by Mytob for
Harvesting E-mail Addresses
wab
php
adb
sht
tbb
htm
dbx
txt
asp
pl
Source: McAfee, Inc. (http://us.mcafee.com/virusInfo/default.asp?id=descrip-
tion&virus_k=132158&affid=108)
Table 4.11
Mytob Eliminates Harvested E-mail Addresses with the
Following Domains 
.gov
gov.
mydomai
.mil
hotmail
nodomai
abuse
iana
panda
acketst
ibm.com
pgp
arin.
icrosof
rfc-ed
avp
ietf
ripe.
berkeley
inpris
ruslis
borlan
isc.o
secur
bsd
isi.e
sendmail
example
kernel
sopho
fido
linux
syma
www.syngress.com
126
Chapter 4 • Common Botnets
Continued
427_Bot_ch04.qxt 1/9/07 3:03 PM Page 126

---

Table 4.11 continued
Mytob Eliminates Harvested E-mail Addresses with
the Following Domains 
foo.
math
tanford.e
fsf.
mit.e
unix
gnu
mozilla
usenet
google
msn.
utgers.ed
Source: McAfee, Inc. (http://us.mcafee.com/virusInfo/default.asp?id=
description&virus_k=132158&affid=108)