I'n Blog 之萬象真藏

Published: 2007-12-24,
Last Updated: 2007-12-24 03:41:39 UTC
by Kevin Liston (Version: 2)

Overview and Blocking Information

Shortly after 0000 GMT 24-DEC-2007 reports came in indicating that the Storm Botnet was sending out another wave of attempts to enlist new members.  This version is a Christmas-themed stripshow directing victims to merrychristmasdude.com.

The message comes in with a number of subjects:

Subject: I love this Carol!
Subject: Santa Said, HO HO HO
Subject: Christmas Email
Subject: The Perfect Christmas
Subject: Find Some Christmas Tail
Subject: Time for a little Christmas Cheer

The body is something similar to:

do you have a min?


This Christmas, we want to show you something you will really enjoy. Forget all the stress for two min and feast your eyes on these.  ;-)

http://merry christmasdude.com/

 
[the domain was interrupted for your protection]

Thanks Kevin for the initial report.

I recommend that you apply blocks on that domain (merrychristmasdude.com) for both outbound HTTP requests and incoming emails.
Under The Hood

The domain appears to be registered through nic.ru and hosted on a fast-flux network of at least 1000 nodes.  Like previous Storm waves, the binary changes approximately every 15 minutes; supposedly updating the peer-list used by the P2P network that the bot-net uses for command and control.

Kevin Liston (kliston -at- isc.sans.org)
資料來源 http://isc.sans.org/diary.html?storyid=3778&rss