< Sicherheit'08: "Monkey-Spider: Detecting Malicious Websites with Low-Interaction Honeyclients" | DIMVA'08: "Learning and Classification of Malware Behavior" >

Storm Worm: World War III?

Tonight the Storm Worm botnet changed the propagation theme again. They have a bogus story, but an interesting picture:


Just now US Army's Delta Force and U.S. Air Force have invaded Iran. Approximately 20000 soldiers crossed the border into Iran and broke down the Iran's Army resistance. The video made by US soldier was received today morning. Click on the video to see first minutes of the beginning of the World War III. God save us.

The directory structure of the website is similar to the previous campaigns:
  • A file called ind.php is included which contains a couple of exploits for common web browser vulnerabilities.
  • The actual Storm Worm binary is called iran_occupation.exe and it behaves similar to previous versions
So actually nothing really new at the botnet side...
Warning: Please do not visit the website visible in the screenshot, it may harm your computer.
This entry was posted by Thorsten Holz on Wednesday, July 9. 2008 at 07:26. and is filed under malware. You can leave a response, or trackback from your own blog. All new comments are subject to moderation before being displayed.

Trackbacks

Trackback specific URI for this entry

    No Trackbacks

Comments

Display comments as (Linear | Threaded)

  1. katsumi says:
    #1 2008-07-09 14:06 (Reply)

    targeting US patriots,
    f6aa81f4d908643b8811f9b94fa76d42 form.exe,
    f6aa81f4d908643b8811f9b94fa76d42 iran_occupation.exe
    the idea that there's really one who thinks occupation of persia would be possible is ...


Add Comment


Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA
 
Submitted comments will be subject to moderation before being displayed.