Friday, June 06, 2008

A Romantic June Storm

On June 2nd, starting at 5:53 PM, the UAB Spam Data Mine started receiving spam messages for the new version of the storm worm. The messages lead to a website titled "Who is loving you?" The "Love Riddles" web page invites you to "Just click here" to find out.

Its been four days since the new round of storm started up. How is the detection rate?

According to VirusTotal, only 6 of 32 AV engines are currently detecting this version of Storm:

What should you be looking for?

So far we've seen these email subjects:

I belong to you
I Wanna Be With You
Just you and me
Missing you
Missing you with every breath
My heart beats just for you
My heart was stolen
Nothing's Gonna Change My Love For You
Stand by my side
Together forever
We belong together
You are my world
You are the ONE
You make my world beautiful
You make my world special

Which contained a single phrase of text, followed by an IP address. Here are the Text lines in the body of the message:

Always on my mind
Can't stay away from you
Crazy in love with you
Dreaming 'bout you
Here in my heart
I want to be with you
I'll Still Love You More
In your arms
Just you and me
Lonely without you
Lost In Your Eyes
Lucky to have you
Missing you
Not the same without you
Somebody loves you
Stand by my side
Together forever
Wanna kiss you
We belong together
You are always on my mind
You are my world
You feel up my senses
You have touched my heart
You make my world special

And here are a list of some of the IP addresses we've seen advertised in the messages: (*) (*) (*)

At this time, only 3 of these IPs, marked with an (*) actually delivered the malware.

No comments:

Post a Comment

Trying a new setting. After turning on comments, I got about 20-30 comments per day that were all link spam. Sorry to require login, but the spam was too much.