April 5th, 2005, 07:45 PM
Mabir Claws into Symbian OS
-First CABIR, now MABIR. Relatively obvious.
- See, they are really relatives but with different attitude.
Advisory here from F-Secure - http://www.f-secure.com/v-descs/mabir.shtml
Exact detection for Mabir.A was published on April 4th, 2005 in database build number 34.
The SIS files that files that Mabir.A sends have always the same file name "caribe.sis". Please note that while Mabir.A uses the name SIS file name as original Cabir worms, it is different worm than Cabir.
- MMS or SMS? Got to research more on this.
In addition of spreading over bluetooth the Mabir.A will also listen for any MMS or SMS messages that arrive to the infected phone. And respond to those messages with MMS message that contains Mabir as "info.sis".