New And Improved Storm Botnet Morphing Valentine's Malware

Malcontent · Feb 13, 2009

Waledac, formerly known as Storm, tries to keep a lower profile while it expands

http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=213403915

Feb 11, 2009 | 02:29 PM
By Kelly Jackson Higgins

the new and improved Storm -- is using its favorite holiday, Valentine's Day, to spread the love with signature phony greeting cards and romance-themed email that Storm so infamously spread in the past.

"Over the last 24 hours, we've seen over 1,000 new variants [of Waledac code]," says Pierre-Marc Bureau, a senior researcher with Eset, which expects Waledac to eventually pump out thousands of variants a day.

"It was a bit lower than what we are expecting. It may not have reached many of our clients yet." That said, it's still a big jump from the around 10 new versions a day Eset had seen the botnet creating, he adds.
Click to expand...

Meanwhile, constantly changing the look and feel of its malware is consistent with the new and improved Storm's M.O.: to avoid attracting too much attention like it used to do. Researchers last month confirmed that Waledac was basically Storm reincarnated, but with all-new malware and a more sustainable architecture that's less likely to get infiltrated and shut down. The notorious botnet Storm went MIA last fall, and researchers started to write it off. But the operators of Storm made a comeback this year with new binary bot code and stronger encryption, plus it replaced its peer-to-peer communications among its machines to HTTP, which helps camouflage its activity among other Web traffic. HTTP also makes it tough to distinguish a bot from a command and control server.
Joe Stewart, director of malware research for SecureWorks, says Storm and Waledac are completely different, however, when it comes to code and files. "It's definitely not the same programmers," he says. But the botnet's overall behavior and strategy is generally the same, he says.
Click to expand...

PROROOTECT · Mar 19, 2009

Waledac's new geo-sensitive social engineering, look here: http://swatrant.blogspot.com/2009/03/waledacs-new-geo-sensitive-social.html

Email-Worm: W32/Waledac.A ... Look to F-Secure Description: http://www.f-secure.com/v-descs/email-worm_w32_waledac_a.shtml

It never will end?

This is beginning ...

Log in or Sign up

New And Improved Storm Botnet Morphing Valentine's Malware

Malcontent Registered Member

PROROOTECT Registered Member

Log in or Sign up

New And Improved Storm Botnet Morphing Valentine's Malware

Malcontent Registered Member

PROROOTECT Registered Member

Useful Searches