DDoS and Security Reports

The Storm Worm is back, this time it’s got a Christmas theme. Who knew that it would take them so long to do this? Here’s a sample mail:

Date: Sun, 23 Dec 2007 21:19:19 -0500
From: geneoldham@usmint.treas.gov
To: ---
Subject: Find Some Christmas Tail

got a sec?

Winter can be cold. I bet you could use a little something to warm you
up. Take 2 min out of your day. You wont regret it. ;-)
hxxp://merrychristmasdude.com/

That domain, merrychristmasdude.com, has a bunch of nameservers and a lot of IPs associated with it – Fast Flux! Here’s the IPs I saw via a global name server after 1000 repeated queries together with their frequencies o observation:

That list is, of course, subject to change.

An infected host will drop the file C:\WINDOWS\disnisa.exe and store the peerlist in C:\WINDOWS\disnisa.config A pair of randomly chosen ports – one TCP and one UDP – will be opened. The following registry entry is added for the malware HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "disnisa" = C:\WINDOWS\disnisa.exe It will sync up the time using NTP and add the following registry entries _HKEY(1352)_\System\CurrentControlSet\Services\W32Time\Parameters "NtpServer" = time.windows.com,time.nist.gov
_HKEY(1352)_\System\CurrentControlSet\Services\W32Time\Parameters "Type" = NTP It will lower the firewall for itself using this command netsh firewall set allowedprogram C:\WINDOWS\disnisa.exe enable It will also add a registry entry to make sure that firewall permission is permanent HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List "C:\WINDOWS\disnisa.exe" = C:\WINDOWS\disnisa.exe:*:Enabled:enable After that, the usual Storm worm mayhem begins.

AV detection for this sample is pretty modest at this point.

UPDATES

Some related links:

• It’s a Stormy Christmas Eve.. from the folks at F-Secure
• Stormworm is back. – Have a Merry Christmas Dude from our friends at DISOG
• Zhelatin.pd, stripshow.exe via the CSIRT blog

Popularity: 3% [?]

This entry was posted on Sunday, December 23rd, 2007 at 10:49 pm and is filed under Arbor Networks - DDoS Experts, Botnets, Malware, Spam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.