« November 2007 · May 2008 · March 2010 »

January 2008
MonTueWedThuFriSatSun
 010203040506
07080910111213
14151617181920
21222324252627
28293031   
February 2008
MonTueWedThuFriSatSun
    010203
04050607080910
11121314151617
18192021222324
2526272829  
March 2008
MonTueWedThuFriSatSun
     0102
03040506070809
10111213141516
17181920212223
24252627282930
31      

Calendar:

  • 28.03.2008: New Packer Statistics
  • 20.03.2008: uc8010.com and 2117966.net Attacks Linked
  • 13.03.2008: Recently Hacked Websites Aiming to Steal Your Passwords
  • 11.03.2008: Intel Strategy Conference - Portland Oregon, United States
  • 01.03.2008: New Whitepaper: RBN "Rizing"
  • 29.02.2008: ISO4 Conference - Sunnyvale California, United States
  • 20.02.2008: NSP-SEC Summit - San Jose California, United States
  • 18.02.2008: Gambling Websites Under Attack
  • 10.02.2008: See below.
  • 09.02.2008: Inbot08 Conference - Aachen, Germany
  • 30.01.2008: Citigroup BITS - New York, United States
  • 28.01.2008: Storm Worm & Stock Spam - The Never Ending Bag of Tricks
  • 09.01.2008: Storm Worm Domains Offline
  • 08.01.2008: Storm goes phishing?
  • 07.01.2008: Storm Worm and Stock Spam
  • 06.01.2008: RBN as RBusiness Network AS40898 - Clarifying the guesswork of Criminal Activity
  • 02.01.2008: Happy New Year to All!
Newest first Oldest first

Sunday, 10 February 2008

Storm Worm Valentine's Day Update


As could be expected, Storm Worm has once again undergone another change as Valentine's Day is approaching. Fresh with 8 different rotating Valentine's Day images and a new executable named valentine.exe (may sound familiar), the Storm Worm may be gearing up for a new round of assaults on inboxes.

It would appear that the domains are no longer serving up wildcard .gif files related to their stock spams. Instead we have eight .gif images ranging from 1.gif on up to 8.gif. After a few moments you'll be prompted to download the binary.

Here's a peak at the 8 images:

=>Posted February 10, 2008, at 03:54 PM by Steven Adair