Storm Trojan Download
Carin Nunziato
The Storm Worm began attacking thousands of (mostly private) computers in Europe and the United States on Friday, January 19, 2007, using an e-mail message with a subject line about a recent weather disaster, "230 dead as storm batters Europe".[6] During the weekend there were six subsequent waves of the attack.[7] As of January 22, 2007, the Storm Worm accounted for 8% of all malware infections globally.[8]
When an attachment is opened, the malware installs the wincom32 service, and injects a payload, passing on packets to destinations encoded within the malware itself. According to Symantec, it may also download and run the Trojan.Abwiz.F trojan, and the W32.Mixor.Q@mm worm.[10] The Trojan piggybacks on the spam with names such as "postcard.exe" and "Flash Postcard.exe," with more changes from the original wave as the attack mutates.[11] Some of the known names for the attachments include:[10]
The compromised machine becomes merged into a botnet. While most botnets are controlled through a central server, which if found can be taken down to destroy the botnet, the Storm Worm seeds a botnet that acts in a similar way to a peer-to-peer network, with no centralized control.[7] Each compromised machine connects to a list of a subset of the entire botnet - around 30 to 35 other compromised machines, which act as hosts. While each of the infected hosts share lists of other infected hosts, no one machine has a full list of the entire botnet - each only has a subset, making it difficult to gauge the true extent of the zombie network.[7] On 7 September 2007, estimates of the size of the Storm botnet ranged from 1 to 10 million computers.[13] Researchers from the University of Mannheim and the Institut Eurecom have estimated concurrent online storm nodes to be between 5,000 and 40,000.[14]
In fact, love-labeled spam carrying variants of the Storm Trojan -- which first appeared in January and got its nickname from subject heads touting news of damaging winter storms in Europe -- was spotted by some security vendors last Wednesday. Trend Micro Inc.'s malware blog noted a round of love-related spam hitting Japanese in-boxes a day before the attack's second stage started.
The attack chain ends with the victim machine infected with multiple unique RAT (remote access trojan) malware instances, such as Warzone RAT and Quasar RAT. Both are used for command and control during different stages of the infection chain.
35fe9a5643