The Riders on the Storm Worm started riding on yet another short term window of opportunity as always - St. Valentine's day with a mass mailing email campaign linking to two files with_love.exe and withlove.exe, using an already infected host as a propagation vector itself in the very same fashion they've been doing so far.Detection rate : 3/32 (9.38%)
File size: 114689 bytes
MD5: 31ac9582674cad4c8c8068efb173d7c7
SHA1: cee93d3021318a34e188b8fae812aa929cb2bc9c
NOD32v2 - a variant of Win32/Nuwar
Prevx1 - Stormy:All Strains-All Variants
Webwasher-Gateway - Win32.Malware.gen!88 (suspicious)
The binary drops burito.ini (MD5 - A65FA0C23B1078B0758B80B5C0FD37F3) and burito1205-67d5.sys (MD5 - C4B9DD12714666C0707F5A6E39156C11), and creates the following registry entries :
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BURITO1205-67D5 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BURITO1205-67D5\0000 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\burito1205-67d5 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\burito1205-67d5\Security
Surprisingly, there are no client-side vulnerabilities used in last two campaigns.
No comments:
Post a Comment