The new target of Waledac Storm worm: Valentine’s day

In the beginning it was Christmas, then Obama and now Saint Valentine! We knew it would be a matter of time and here we have again spam messages related to this special day.

PandaLabs has detected a new variant of this worm, W32/Waledac.C.worm, which now uses Saint Valentine as bait to spread itself and affect as many computers as possible. The Waledac worm is being distributed via email in messages that use the subject of love before Saint Valentine’s day and contain one of the following links:

hxxp://goodnewsreview.com
hxxp://worldnewseye.com
hxxp://www.spacemynews.com
hxxp://www.worldnewsdot.com
hxxp://www.worldtracknews.com
hxxp://www.wapcitynews.com
hxxp://linkworldnews.com
hxxp://goodnewsdigital.com
hxxp://waleprojekt.com
hxxp://expowale.com
hxxp://topwale.com
hxxp://waleonline.com
hxxp://goodnewsdigital.com
hxxp://wapcitynews.com
hxxp://bestgoodnews.com
hxxp://spacemynews.com
hxxp://linkworldnews.com
….

When clicking the image, a file whose name is related with love will be downloaded. In fact, this file is the worm:

youandme.exe
onlyyou.exe
you.exe
meandyou.exe

 

The size of the files is always around 390Kb.

This reminds us of last year’s Storm worm wave which was one of the main threats during 2008. Let’s hope it isn’t as active as last year’s but…the Waledac’s storm has already started!!!

Thanks to Asier Martinez for the information.