The storm botnet has been quiet since its last spam run during Halloween. But on Christmas eve the storm botnet started spreading Christmas themed email. The emails have similar content to previous storm emails, with a short message and a link.

The link points the the following website that advertises a strip show program. Clicking on the page will prompt the user to download stripshow.exe, which is the storm bot.

At the time that these emails were first being sent stripshow.exe was only detected by six of the 32 antivirus engines on viustotal.

The day after Christmas the theme of the emails changed to New Year. The emails have subjects such as:

New year wishes for you

New year ecard

Happy 2008

A fresh new year

Opportunities for the new year

Message for new year

We are currently still seeing these emails coming in.

Clicking the link will take you to the following page. The download does not start automatically but clicking on the 'click here' link will prompt you to download happynewyear2008.exe, also the storm bot.

These web sites are hosted on a fast flux network of computers that have already been compromised by the storm bot, making it very hard for anyone to take down the domains.

Just after we posted our blog entry yesterday about the Pushdo/Celebrity botnet, another stream of celebrity malware-laden spam came in last night. As usual, the gang was using Angelina Jolie in the message.

If executed, the attachment downloads a spam bot and begins sending spam. Today the bot was sending out the following image spam at a considerable rate, we measured it at about 800 messages per hour.

Both the web sites heldbear.com and goodlone.com are hosting pages of an online drugstore called the Canadian Pharmacy. We checked the domain name registry and both sites were registered in China by someone named Liu Hai – which happens to be the name of a Chinese god of wealth and prosperity.

A few days ago, a great analysis from SecureWorks on the Pushdo Trojan was published. The group behind this Trojan is none other than the Celebrity Gang, which we have commented on before as being a major spam player. Our observations indicate that this gang’s botnet is responsible for over 20% of spam at present.

Several interesting points came out of this analysis which illustrates the sophistication of this malware distribution mechanism:

• The Pushdo Trojan itself is a downloader that seeks to download and install additional components from a remote server.
• A custom HTTP protocol is used for communication instead of IRC.
• The server distributes a number of malicious files, including spambots and password stealers.
• The system is country ‘aware’, potentially limiting files to certain countries or groups of countries.
• The malware keeps tracks of the computer’s IP address, hard drive serial number, OS version, and how many times a Pushdo variant has been run, which presumably is an anti-malware-analysis feature.
• It also checks which anti-virus and firewall products are running. It doesn’t disable them, it just notes the processes and reports back to the server.

If the amount of spam this botnet is responsible for is anything to go by, the Pushdo/Celebrity gang has indeed succeeded in creating a sizeable botnet.

This week we have been receiving spam emails that tell the recipient that they have received an ecard from yahoo greetings.

Clicking the link will take you to a forged americangreetings.com website. Both Internet Explorer 7.0 and Firefox browsers warn the user of a suspected phishing attempt.

If you ignore this warning you see the following page:

A message asks the user to update their flash player and provides a link to get the latest version. The link asks the user to download a malicious macromedia-flashplayerupdate.exe.

One of the main functions of this program is to send spam. We have observed it mass mailing e-card messages like the one above in order to lure more potential victims to the forged website. In addition to this it sends out short bursts of other types of spam. One type is this phishing spam:

Clicking the link will take you to the phishing website below that asks visitors to hand over personal details.

another type of spam being sent was this:

We calculated that one of these spam bots will send out almost 1400 messages an hour. The spam bot operates in bursts, presumably pausing to periodically download new templates and address lists.

As each year draws to a close, there is a consistent pattern of increased spamming activity, typically focused around Christmas Spam .

In 2006, the traditional increase arrived early thanks mainly to the effects of the Stration worm. Below is our Spam Volume Index (SVI) for the latter half of 2006 – the SVI is a relative measure indicating the amount of spam being sent Worldwide from week to week. As we can see, during October 2006 spam volumes increased by 40 – 50%, and this elevated level became the new norm for the New Year.

2007 became the year of sophisticated botnets, novel spam ideas (PDF spam, for example) and the merging of malware and spam activities. In our SVI below we can see that, despite the changing landscape, the familiar end-of-year spike is here again. It's a little late this year, but is of a similar scale to last year.

Unfortunately, if past years are anything to go by, this new volume can be expected to be maintained by the spammers. While we can hope for a drop-off in early 2008, experience suggests that this might not happen.

Earlier this week we commented that malware was increasingly being spread via the web. Today we received this harmless looking email that doesn’t contain much other than a short message and a reference to a website. The website appears to serve two different functions, one is to increase the search rankings of other pages and the second is to install malware on a visitor’s computer.

The website appears to have nothing malicious about it; however it is common for attackers to target high profile and trusted websites. By not altering the look of the site visitors will not even be aware of malicious activity going on in the background.
We quickly discovered that this page is not as innocent as it looks and it appears that someone has added two separate bits of code to the front page. Both seem to serve a different purpose.

In the page source are almost 200 links to four websites with different variations of cialis and viagra references. An HTML tag at the start of the links tells the browser not to display these links. The reason for this is to reduce the chance of someone noticing that the site is compromised, while still allowing search engines to read the links.
Most search engines use links in one website to increase the rank of the website being linked to. With enough compromised sites hosting links to a single website, that site can be given a higher ranking in a search engine. So if someone decided to search for ‘buy cialis online’, one of the sites pictured above may have enough links to it to put it near or at the top of the search results and increase the chance of the searcher going to that site.

The second bit of code is a JavaScript section that contains more JavaScript that is encoded in an attempt to hide the script’s real function.

When this is run it adds more JavaScript to the page. The script appears to be trying to exploit eight different vulnerabilities. Six of these were targeting Microsoft Internet Explorer through vulnerabilities in various ActiveX controls. The other two were targeting the Apple QuickTime plug-in.

Many of these vulnerabilities have software patches available but it only takes one vulnerable piece of software to make you a victim of this type of attack. You should always make sure your browser and other software have the latest updates installed. Disabling JavaScript and ActiveX in your browser can also reduce the chance of a successful attack.

We have not seen much from the stock spammers lately. Stock spam levels have recently dwindled to almost insignificant levels:

But today, to our surprise, we saw a return of image stock spam which we have not seen for some months now. The numbers, while not huge, are significant. Moreover, the style of the message structure and image, complete with colorful randomized words, is identical to that seen earlier in the year. It seems the stock spammers, after a considerable underground hiatus, have picked up their tools and started again. Whether it will be a long-lived phenomenon, or the final death throes of stock spam, remains to be seen.