Mydoom

Overview

Worm:Win32/Mydoom (also known as Novarg or Shimgapi) is a historically devastating, incredibly fast-spreading mass-mailing worm and backdoor that caused massive global internet slowdowns, email server outages, and orchestrated massive DDoS attacks in 2004.

Understanding Mydoom
To the end-user in 2004, Mydoom manifested as an inbox flooded with bounce messages or deceptive emails carrying malicious attachments. For IT administrators, Mydoom was a nightmare of bandwidth exhaustion; at its peak, it was estimated that 1 in every 12 emails sent globally was a Mydoom variant. It is considered one of the fastest-spreading worms in history. Its primary objectives were rapid propagation via email and P2P networks (Kazaa), establishing a backdoor on infected hosts (TCP port 3127), and launching a coordinated DDoS attack against SCO Group and Microsoft.

Execution and Evasion Strategies
Mydoom spread primarily via email. The user received an email with a deceptive subject line (e.g., 'Error', 'Mail Transaction Failed') and an executable attachment disguised as a text file or ZIP archive. Upon execution, the worm copies itself to the Windows System directory and establishes persistence via Registry Run keys. It aggressively scans the hard drive to harvest email addresses. Using its own built-in SMTP engine, it blasts out thousands of copies of itself. Crucially, it opens a backdoor (listening on TCP ports 3127-3198), allowing the attacker to remotely execute arbitrary code, which was frequently used to drop secondary malware.

Indicators of Compromise & Impact
The impact is massive email server congestion and endpoint compromise (via the backdoor). Incident responders will observe a massive spike in outbound traffic on TCP port 25 (SMTP). A definitive Mydoom IoC is an unauthorized process listening on TCP port 3127. The presence of a file named `shimgapi.dll` in the System32 directory is a classic indicator.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.004: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_MYDOOM {
    meta:
        description = "Detects Mydoom (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "mydoom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Mydoom Activity
id: 08893d1736b3ec9815fd16f00d312fd6
status: experimental
description: Detects generic indicators of the mydoom malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*mydoom*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the endpoint immediately to halt the outbound mass-mailing campaign and sever the active backdoor listening on TCP 3127.
2. Enforce egress firewall rules blocking outbound TCP port 25 from all endpoints, forcing all email traffic through authorized corporate mail relays.
3. Utilize EDR or network scanners to identify any hosts with open, listening ports in the 3127-3198 range.
4. Assume total endpoint compromise; perform a clean OS rebuild, as the backdoor was frequently used to install additional rootkits and malware.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the infection as a 'low severity' spam issue; the open backdoor provides full remote command execution to any attacker.
2. Avoid assuming the threat is contained just by stopping the spam; ensure the initial vector is purged from all mailboxes.

References & External Analysis

• Search "mydoom" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: backdoor)

Explore other malware families in the same category:

• Meterpreter
• Teamviewer
• Shadowhammer
• Doublefantasy
• Rpdpatch

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/mydoom.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.