Storm Worm: third round
Posted by: Marco Giuliani
We're at our third episode of "Stormy: the Christmas lover".
Outbreak is still going on, even if looks like the impact of the attack is slowly reducing.
Until now, we've monitored in our database more than 400 variants of the third Stormy version we've seen in these four days and we're seeing since some hours a fourth version, using another different and custom made runtime packer.
Other two domains has been registered and opened to drop Stormy and the file names are now: happy-2008.exe and happynewyear.exe.
Last versions of Stormy worm are using a rootkit component to hide infection components.
After launched, the dropper create a new service and a driver under Windows System directory called clean[4 random chars]-[4 random chars].sys or bldy[4 random chars]-[4 random chars].sys
Driver will hook three Windows native API: ZwEnumerateKey, ZwEnumerateValueKey, ZwQueryDirectoryFile. Goal is to hide its registry keys and files.
As side effect, it'll hide every file that contains the strings "clean" or "bldy" in its name.
Spam routine will avoid to send e-mail to e-mail addresses containing one of these strings:
even mixed together each other or with receiver address into the body. Body will contain link to last two registered domain: happycards2008.com or newyearcards2008.com.
A random UDP port is then opened so that the infected PC can join to a huge botnet. Port opened is listed into the file clean.config, created by the malware under Windows System directory and hidden by the rootkit.
Technique used by Stormy rootkit to hide its components is quite old and detected by Prevx CSI easily.
If the attack is currently known - technically speaking - and security companies are updating their software , now a question arises: why are these fake domains still active? If servers behind website are costantly changing so that it would be impossible to shut them down, these servers are reached by four well known domains. Why, after four days, hasn't anyone succesfully taken these domains down?
Only cooperation between security companies, ISP and law enforcement agencies can become the deadly weapon against these teams who write malware and who could potentially shut down several crucial international servers with their botnet.
Hoping that smell of money wouldn't persuade anyone to not collaborate.
Taking down the domain names used as the fast-flux hosts seems on the surface to be a means for shutting down this operation. However, it is like the arcade game whack-a-mole. Whether you elect to suspend the domain name, or you elect to notify every ISP of every infected machine, the result is the same. No sooner do you remove one part of the problem, than other parts pop up to continue the infection.
Storm requires a more concerted effort at containment. The best effort to date has been Microsoft's addition to its automated update distribution system, last September, that detected and removed the Storm infection (MSRT) on a massive number of machines automatically.
All AV vendors need to ensure that their software is able to both remove existing infections, and prevent infestations from occurring.
The last and most important step is for individual users to make use of the AV and Microsoft update initiatives to clean up their machines.
PS: Of course, the ultimate solution is the long term incarceration of the criminals behind this scourge on the Internet.