Clever new voluntary-virus morphology

[prog]

You get an email that actually looks like it may have been composed by a native English speaker welcoming you to a web-based community you may not necessarily recall asking to join, and providing a raw numeric IP address (uh oh) as a confirmation link.

Clicking the link calls up a bare-naked web page (uh oh) with a single line of text apologetically informing you that you need to download (uh oh) a "secure login" thingum to actually see the website, and offers another link to an .exe file (uhhh ohhh).

I assume that carrying on with the download and running the file would (if I were on a Windows box) instantly zombify my PC and put it to use making DDoS attacks against the Turkish government or whatever they're up to now. When it comes down to it I guess I'm really just impressed that the initial email actually doesn't look entirely unreasonable, except for the giveaway raw IP link.

Comments

[jaq.livejournal.com]

Yes I've had several of those in the last couple of days, though I didn't bother to follow the link.

[prog.livejournal.com]

It was so different than the usual "This am BAnk of Ammerica! We shut down ur Account unless you Click Here -> OK!!" that I just had to see how far down it went.

[keimel.livejournal.com]

Every single one I've received (not in gmail filtered accounts, but talker.com ones) have been pointing me at a different zombified web server to download the payload. I've forwarded every one to their respective abuse departments for whatever good that will do.

I was noticing this new method as well. It's a good one in study of legit emails from communities. If they culled the lists from some real communities people were on, it'd be nicer, but they do appear to be somewhat random. I am not on any dog communities, but remember one being indicated as my membership.

They also targeted an email address for which I don't generally sign up for memberships. ;)

[chocorisu.livejournal.com]

According to The Register this is the latest version of the Storm Worm, the one that's been "belching out toxic ecard scams". Lots of very sneaky metamorphic code stuff in there making it hard to detect. You don't want that on your PC!

[karlvonl.livejournal.com]

Woah, I just got one of those. And thanks to you, I had to click the link just to see. :-)