Storm Worm: follow up
Posted by: Marco Giuliani
We've monitored the situation today, even though the Storm worm is back a bit before our expectations.
Again, in Storm gang tradition, they made use of a new polymorphic packer to delay detection of the new release by antivirus companies.
We've monitored during last 40 hours 253 different repacked variants of the Storm worm release, this means a new variant every 9 or 10 minutes. Definitely a nightmare.
A part from this, nothing really new technically speaking from the last version released over Christmas time.
The rootkit dropper is named burito[postfix].sys and the config file is called burito.ini, both dropped inside Windows System directory.
But, knowing how many times the Storm gang changed the rootkit prefix name during last attack, we are expecting a change is going to be made when most of antivirus companies will detect this release.
Actual subjects and mail body texts used to spread the malware are these:
The good news is that we detect all variants as Stormy:All Strains-All Variants.
Everything looks like its going like the Christmas attack, so we expect this wave is going to hold up for the next few days.
We'll continue monitoring the situation.
