New Storm Worm In The Wild...

FYI…

- http://isc.sans.org/diary.html?storyid=2612
Last Updated: 2007-04-12 20:54:39 UTC …(Version: 10) ~ "…The Subject of the email (that we have seen so far) say:
"Worm Alert!"
"Worm Detected"
"Virus Alert"
"ATTN!"
"Trojan Detected!"
"Worm Activity Detected!"
"Spyware Detected!"
"Dream of You"
"Virus Activity Detected!"
It has two attachments, one being an image with 'panic-worded text', and the other is a password protected zip file, whose password is revealed in the image. The zip file appears to be named:
"patch-.zip"
"bugfix-.zip"
"hotfix-.zip"
"removal-.zip" …"

- http://www.pcworld.com/printable/article/i…/printable.html
April 12, 2007 03:00 PM PDT ~ "…Postini*, an e-mail security company, says that over the last 24 hours it has seen about 55 million virus e-mails, about 60 times the daily average. The first e-mails had romance-themed subjects: "A kiss so gentle," or "I dream of you," for instance. The latest batch attempts to fool readers–with subjects like "Worm Alert!" or "Virus Alert!"–into thinking they are already infected and need to apply a supplied patch–an attached virus… Cloudmark, another e-mail security company, says it sees similar outbreak numbers. Today's flood is ten times as large as one this past Sunday, which also involved the virulent Storm Worm…"
* http://www.postini.com/stats/index.php

> http://www.informationweek.com/shared/prin…cleID=199000691

<_<

Ongoing…

- http://www.f-secure.com/weblog/archives/ar…7.html#00001167
Friday, April 13, 2007 - Posted @ 02:19 GMT ~ "Earlier today, several e-mails with love themed subjects were seen in the wild. While some of the subjects are a rehash of previously used subjects such as Sending You My Love, The Dance of Love, and When I'm With You, others are new:
A Dream is a Wish
A Is For Attitude
Eternal Love
Eternity of Your Love
Falling In Love with You
Hugging My Pillow
Inside My Heart
Kisses Through E-mail
Our Journey
Sent with Love
When Love Comes Knocking
You're In My Thoughts
You're the One …
The e-mail messages themselves have no text, instead, they have attached executables with romantic sounding filenames. These include:
Love Card.exe
Love Postcard.exe
Greeting Card.exe
Postcard.exe …

> A second run occurred after a few hours. This time, the subjects were security related. Subjects include:
ATTN!
Spyware Alert!
Virus Alert!
Worm Alert!
Worm Detected!
Furthermore, the message body is an image file which advises the receiver to patch their systems. Also included within the image is a password in order to extract the attachment… Something new to the Zhelatin family is the use of a password protected Zip archive as an attachment. The filenames vary but they have the following format:
patch-[4 to 5 random numerical characters].zip
hotfix-[4 to 5 random numerical characters].zip
The executable contained within the Zip archive has the same name as that of the archive but with an EXE extension…"

FYI…

- http://www.informationweek.com/shared/prin…cleID=199000950
April 13, 2007 ~ "…The Internet Storm Center reported detecting at least 20,000 infections, while the Security Response Team at Symantec said they received several hundred thousand reports of the malicious e-mail making the rounds. That all changed on Friday morning when the attack went quiet… Encrypting the malicious code makes it much more difficult for anti-virus programs to catch it, and if they can't catch it, they can't stop it. If a user opens the file, his machine is infected with the malware and it then connects to a peer-to-peer network where it can upload data, including personal information from the infected computer. It also can download additional malware onto the infected system. The fact that infected computers connect through a peer-to-peer system and not to a standalone server or even a node makes it extremely hard to shut down… Paul Henry, VP of technology evangelism with Secure Computing, said in an interview that this latest Storm attack was aimed at building out the hackers' botnet. "The whole end game is building a bigger, better botnet," he said…"