Storm Worm Reappears

It's baaack: The bot code used in the infamous, massive Storm botnet that was taken down nearly two years ago is being used to build another spamming botnet. Researchers have reverse-engineered the tweaked version of the original Storm code, which so far has spread somewhere between 10,000 to 20,000 machines.

Researchers don't know for sure whether it's the same botnet gang that drove the original Storm and then its predecessor, Waledac -- both of which are no more -- but they have identified two-thirds of the same elements in this latest version as in the original Storm code version. Noticeably missing is Storm's trademark peer-to-peer component: This version is all HTTP-based rather than the hybrid P2P/HTTP approach in the old botnet, which at one point swelled to a half-million bots. Storm began to fade away in the fall of 2008 after researchers were able to successfully disrupt its operations on more than one occasion.

Waledac, which boasted 60,000 to 80,000 zombies, was downed in February by a sneak attack from a team from Microsoft, Shadowserver, the University of Washington, Symantec, and a group of researchers from Germany and Austria who had first infiltrated the botnet last year.

Joe Stewart, director of malware research for the counter threat unit at Secureworks and known for his previous research on Storm, says he believes another person or group has procured the code and stripped out the P2P element. "From everything we've seen, it looks like the original Storm crew moved to Waledac...so what strikes me is that they stripped out the P2P and sold the spam code to another group to build a more simplified botnet," Stewart says. The P2P feature had been targeted by researchers, which made it less appealing, he says.

"They don't have to have peer-to-peer to make this thing work. It seems they [wanted to] get some more value from this old code base," says Stewart, who has seen between 10,000 and 20,000 infected machines thus far. "This is definitely not the same botnet -- it's a new botnet using Storm's original code."

Steven Adair, a researcher with the Shadowserver Foundation who was one of the first to spot the recycled and made-over Storm malware earlier this month, says the similarity to the original malcode is striking. "The user agent is the same, and it had a weird typo in it [like the original Storm], which is how we found it," Adair says.

He passed the sample to the Honeynet Project, which reverse-engineered it and found other similarities in the code, including the same command protocol, which is made up of a two-phase handshake, according to researchers there. Felix Leder, one of the Honeynet researchers, noted that two-thirds of the functions in the malware were basically cut and pasted from the original code.

Leder says the file itself looks different, however. "It has some protection around the actual code -- a packer -- that looks different," he says.

And there are still several weaknesses in the protocol, he says. "We are really astonished that they didn't improve that but just reused the code. Either they don't learn from their previous mistakes or it has been a different group that doesn't understand the design but just took the code, or they just don't care," says Leder, who, along with Honeynet members Mark Schloesser and Tillmann Werner, is still studying the botnet.

And its core function, like Storm, is for spamming and distributed denial-of-service (DDoS) attacks. "And it's still being controlled using the same template format," Secureworks' Stewart notes.

Stewart and Shadowserver's Adair have separately seen just one visible command-and-control server for the botnet, which they say is likely a proxy masking the rest of the botnet infrastructure. "They are already getting templates and sending out spam," says Adair, who notes that this new botnet so far doesn't appear to be as robust as Storm.

Researchers at Computer Associates, meanwhile, have spotted the new Storm malware being bundled with a Trojan downloader, along with fake antivirus software, as well. CA says the so-called Win32/Pecoan variant has been pumping out a spam email campaign using fake pharmacy, male impotency, adult dating, and celebrity scandal message lures.

The botnet so far isn't sending the same brand of socially engineered email messages that were characteristic of Storm, which capitalized on the latest news and were sent out during holidays, Stewart says. "This one is sending very typical spam," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.