{
  "family": "bobax",
  "sample_count": 5,
  "category": "advanced_threat",
  "description": "Worm:Win32/Bobax is a classic, historically significant computer worm and botnet agent known for its aggressive propagation mechanisms and its primary function of transforming infected machines into massive spam relays (zombies). Emerging in the mid-2000s, Bobax was a major player in the global botnet ecosystem, frequently utilized by cybercriminal syndicates to blast out pharmaceutical spam, phishing emails, and distribute other malware.<br><br><b>Understanding the Bobax Worm</b><br>To an end-user, a Bobax infection might cause severe internet slowdowns and system sluggishness due to the massive volume of outbound email traffic. For a network administrator, Bobax is a severe threat that can quickly result in the organization's IP space being blacklisted by global anti-spam organizations (like Spamhaus), crippling legitimate corporate email communications.<br><br><b>Execution and Spreading Mechanics</b><br>Bobax primarily propagated by actively scanning the internet for machines vulnerable to known Windows exploits, most notably the LSASS vulnerability (MS04-011) and the RPC/DCOM vulnerability (MS03-026) (`T1210`). Once a vulnerable machine was found, Bobax exploited it to execute a remote shell and download a copy of itself. Upon execution, it dropped a copy into the `System32` directory and established persistence via the Registry Run keys or by injecting itself into the `svchost.exe` process (`T1543.003`, `T1055`). It then reached out to a hardcoded list of C2 servers (or used peer-to-peer mechanisms in later variants) to download spam templates and lists of target email addresses. Finally, it established its own internal SMTP engine to blast out thousands of spam emails directly from the victim's machine (`T1498.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact was severe network congestion, IP blacklisting, and participation in global cybercrime. Host-based IoCs included `svchost.exe` utilizing high CPU and memory, and establishing thousands of outbound connections on port 25 (SMTP). Network IoCs were dominated by massive, anomalous spikes in outbound SMTP traffic originating from standard workstations (which should normally only talk to the corporate Exchange server).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1543.003",
    "T1055",
    "T1210",
    "T1498.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services (MS04-011 / MS03-026)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1498.002",
      "name": "Network Denial of Service: Reflection Amplification (Used for Spam/DDoS)",
      "tactic": "Impact"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Hiding in svchost.exe)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected endpoint from the network to stop the outbound spam flood and prevent the IP from being blacklisted.",
    "Block outbound port 25 (SMTP) traffic from all endpoints at the perimeter firewall, allowing only the designated corporate email servers to send mail.",
    "Ensure all legacy Windows systems are patched against MS04-011 and MS03-026, or decommissioned entirely.",
    "Monitor IP reputation services (like MXToolbox) to ensure the organization's public IP has not been blacklisted due to the Bobax activity."
  ],
  "what_to_avoid": [
    "Do not allow standard workstations direct outbound access to the internet on port 25; this is the primary enabler for spam botnets.",
    "Avoid relying solely on local AV scans, as worms like Bobax heavily utilize process injection to hide from standard file-based detection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}