Mydoom

Description

Mydoom is a mass mailing worm from 2004 whose emails used variable subjects, bodies, and attachment names to slip past users scanning their inboxes. When executed it opened Windows Notepad filled with garbage data, and its packed body encrypted its strings with ROT13 to hinder analysis. The worm opened a backdoor on infected machines by planting a DLL and launching it as a child process of Explorer, and it launched a denial of service attack against www.sco.com, with its spreading designed to stop on February 12.

Stats

First seen

May 2022

Last seen

October 2026

Also known as

Alert name variants

References

• malpedia.caad.fkie.fraunhofer.de →