As Valentines Day approaches, we see theStorm team have made yet another change in an effort to furtherpopulate their army of bots. A subsection of their herd that have beenhosting the Valentines-related content now presents the visitor withone of eight randomly themed images and bestows upon them the gift of"valentine.exe," detected as eitherTrojan.Peacomm.D or Trojan.Peacomm.
The page serves up a random image file per visit (or refresh of thepage), probably via some server-side scripting. A five second delayusing a meta-refresh tag provides enough time to enjoy the image beforebeing prompted to save the executable on the local system. A recentperusal of our spam trap continues to catch a large number of emailswith a Valentines Day theme containing a hyperlink to one of manymalicious IP addresses under the control of Storm.
Surely after such a long and malicious campaign by the Storm crew,widely-publicized on the Web, no one would still fall for these kindsof threats? Recent history disagrees. Holiday theme-based threats haveenjoyed great success, dating back to at least 2000 and every yearattackers are successful in compromising machines via constructed emailmessages. While the messages change from year to year, the mitigationstrategy remains the same, which includes keeping your antivirussignatures up-to-day and treating all emails that arrive in your inboxcarefully.
Update - February 12th, 2007:
The emails come in with one of the following subjects:
A Rose To Say...
I Like You
Is Anything Beautiful As A Rose?
Lovetrain
My Heart For You
My Heart
Poem About Us
Powerful Love
Smiley Kiss
Tower of Love
Val-ANT-ines
World Love
You Stay In My Heart
Just You
Love Rose
You're my Valentine!
Each email contains a different message body and link. The email body may be one of the following:
Me & You
My Heart For You
You Stay In My Heart
My Love For You
Valentine Invitation
Smiley Kiss
World Love
With All My Love...
Just You
World Love
Valentine Dad
With All My Love...
My Heart For You
I Like You
Rockin' Valentine
Is Anything Beautiful As A Rose?
Update - February 13th, 2007:
Two fast-flux domains, moonstarfood.com and destroythemoon.com, havenow been registered and are being distributed by email, as well asforum and blog postings. Visitors to these domains will be prompted todownload valentine.exe from one of the numerous Storm bot nodes.