Waledac Botnet Increasingly Bombarding Inboxes with Spam!

Security experts are warning everybody - stay alert and don't allow spammers to trick you, infect your computer and steal your personal and financial information. That's exactly what a simple, at the first sight, email message with an innocent-looking attachment or link can do. And although it's impossible to prevent those cyber criminals from spreading malicious emails, we can at least inform you about the most recent spam campaigns. This is what I'm going to do right now in this article.

Since last December, Waledac botnet has been increasingly bombarding our inboxes with various malicious spam messages prompting users to either click on the provided link or to download an attachment. The most recent spam campaigns related to Waledac offer users:

• free foot fetish movies
• online casino advertisements
• the ability to spy on somebody else's (for example, a lover's) SMS messages with a special program

In the first two cases users are prompted to click on the provided links that then redirect them to websites featuring videos or advertisements. In the spam campaign with the SMS spy program, potential victims are prompted not only to click on the provided link but also to download a special spy program for a free trial (see the three screenshots below).

The link "Download Free Trial" leads to the download of an executable file (free.exe; smstrap.exe; install.exe; setup.exe etc.) which installs a Waledac bot into the user's system. When clicked, a Trojan file with MD5 ae9404cf5996d04a5ed8e32daf7cdbe1, MD5 e850623f01998ea2547fb7fcd088b559, MD5 890bf32b34b7abab7aa7ea049215c429 or MD5 05853afd4cdd87e9f1ae03226ca0ff02 will be downloaded on the user's system.

The following tables present other known aliases of the Trojan, downloaded by the four executable files. Since this antivirus detection information was collected on the 17th of April, there may already be new variants of this malware that are not given in the table.

Table 1.  Alias Names of Trojan dropped by free.exe                                                                               Table 2: Alias Names of Trojan dropped by smstrap.exe

                                                            Table 4.  Alias Names of Trojan dropped by setup.exe

Table 3.  Alias Names of Trojan dropped by install.exe                                                                    

Once again you are strongly advised to beware of unsolicited email messages even though they may appear to come from legitimate sources. Clicking links in these messages almost always leads to malware or to malicious web pages. Don't allow cyber criminals to trick you: protect your computer and yourself! Use appropriate anti-virus software and anti-spam filters and keep them up-to-date.