Storm Worm Changes Course

[Humpty]

The authors of the Storm worm (also know as Trojan.Peacomm) have shown an uncanny knack of changing or shedding key components of the threat in order to enhance its persistence and spread. This week saw the latest incarnation of the threat, Trojan.Peacomm.D, reveal itself as halloween.exe or sony.exe. What is most interesting about this latest variant of the Storm worm is that its authors have removed some key functionality that was present in the previous variant, Trojan.Peacomm.C. Specifically, the threat no longer;

1. infects other legitimate drivers on the system. Previous variants infected drivers such as Tcpip.sys and Kbdclass.sys. This was a stealth-like feature used by the threat to start early with the operating system and without loading points in the Windows Registry.

2. injects itself into legitimate processes like Explorer.exe and Services.exe.

 

Instead the threat now relies less on legitimate components on the operating system and has new proprietary components to do its dirty work. The driver associated with the latest variant, noskrnl.sys, works hand in hand with the user mode noskrnl.exe to provide the same stealth-like capabilities that involved more components, both illegitimate and legitimate, in the past.

Symantec Article

[Caldor]

Gotta keep farming that bot net they built eh. Oh well atleast it drums up business

[craigathus]

The morons that start "crap" like Storm worm need to get a life!

No, on second thoughts, they need a Life Sentence!

[Andavari]

The morons that start "crap" like Storm worm need to get a life!

No, on second thoughts, they need a Life Sentence!

If caught malware authors can get some lengthy sentences and fines. Although some hard yet ironic justice would be locking them up in prison, and giving them worms to eat for their daily food intake.

[Caldor]

$20 000+ USD per month is alot of an incentive for a struggling russian or asian hacker. And most dont get caught. For us who have real jobs and had the luxury of growing up in a stable first world country we simply cant appreciate the hardship some of them have. A few bowl of rice a day and two years of saving for an old computer! I have heard that many times before. They hang our on IRC and sell malware there.

[LUSHER]

$20 000+ USD per month is alot of an incentive for a struggling russian or asian hacker. And most dont get caught. For us who have real jobs and had the luxury of growing up in a stable first world country we simply cant appreciate the hardship some of them have. A few bowl of rice a day and two years of saving for an old computer! I have heard that many times before. They hang our on IRC and sell malware there.

 

20,000 USD per month seems to be a lot of incentive even if you live in first world countries, unless you are very wealthy...