Waledac worm targeting July 4 spam offensive

I happened to notice the filename of the image in the article:

​

During the conficker fiasco, some researchers made a connection between Storm - Waledac - Conficker, based on the prevalence of email spam.


REFERENCES

New Downad/Conficker variant spreading over P2P
http://countermeasures.trendmicro.eu/new-downadconficker-variant-spreading-over-p2p/

Report: Conficker in attack mode
http://news.zdnet.com/2100-9595_22-292858.html

Brief Storm/Waledac Timeline and Its Relationship with Conficker
http://www.mxlogic.com/itsecuritybl...eline-and-Its-Relationship-with-Conficker.cfm

----
rich

 

Thanks, Ron. If their conclusions are correct, that might be a reason why Conficker didn't seem to do much at first -- just biding time waiting for opportunities to distribute malware.

----
rich

 

Does anyone know where there is a list of the domains used by this worm? I'd like to blackhole DNS for them to help protect my customers in the short term.

Thanks,

Henry

 

Here are a couple of lists. You can search around for others:

Full Waledac Domain Listing
http://www.securityzone.org/?p=61

Waledac - New Campaign, New Domains, GeoCities, and SpywareProtect2009
http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20090416

Assuming the Conficker botnet will be involved, it won't be so easy to keep track. To wit:

Conficker C Analysis
http://mtc.sri.com/Conficker/addendumC/

The Waledac trojan came with a later variant of Conficker, and it's not been established whether or not it includes C's domain generation feature.

Nonetheless, going back to the original Storm exploits, as domains were taken down, new domains were generated daily. So, we should be prepared for similar activity.

Also variants of the trojan payload continally changed, making detection more difficult for anti-malware products.

As far as protecting your customers: evidently the initial attack is via email, enticing the victim to click on a link to go to the bad site.

----
rich

 

Hey Rich, thank you very much, that's exactly what I was looking for!

Henry

 

You are welcome, and good success to you in protecting your customers!

----
rich

 

The Fireworks have started!

Here is an early example:

Waledac Independence Day Theme - New Campaign In The Wild
http://securitylabs.websense.com/content/Alerts/3431.aspx

I notice that this is an almost exact copy-cat from last year. See my thread here:

https://www.wilderssecurity.com/showthread.php?t=214046


----
rich