Cabir
Threat LevelDamageDistribution

Effects 

Cabir.A has no damaging effects as it just displays the message Caribe on screen every time the mobile phone is switched on.

Infection strategy 

Cabir.A creates the following files:

• CARIBE.APP in the directories \SYSTEM\ APPS\ CARIBE\ and \ SYSTEM\ SYMBIANSECUREDATA\ CARIBESECURITYMANAGER.
• CARIBE.RSC in the directories \ SYSTEM\ APPS\ CARIBE\ and\ SYSTEM\ SYMBIANSECUREDATA\ CARIBESECURITYMANAGER.
• FLO.MDL in the directories \ SYSTEM\ APPS\ CARIBE\ and \ SYSTEM\ RECOGS.
• CARIBE.SIS in the directories \ SYSTEM\ INSTALLS\ and \ SYSTEM\ SYMBIANSECUREDATA\ CARIBESECURITYMANAGER.

Means of transmission 

Cabir.A spreads to mobile phones with a Symbian operating system and Bluetooth technology. In order to do so, it follows the routine below:

• When Cabir.A is executed, it displays the message Caribe on screen.
• Then, it starts searching for other devices with Bluetooth technology built-in in order to spread to them.
• If successful, Cabir.A will send a copy of itself, in a file named CARIBE.SIS, to the first device it finds.
• Cabir.A can also spread to other devices with the Bluetooth technology built-in but an operating system other than Symbian. However, if this occurs, the worm will not be able to spread out from that device.

Further Details  

Cabir.A.worm is 15,092 bytes in size.