Storm Codec or Storm's new Trap...

You have no Storm Codec installed on your PC.
Download it and choose either "Open" or "Run".
Enjoy your multimedia experience….

Storm botnet is back with its new social engineering based traps. Unsolicited emails are sent to users that tempt them to watch some interesting video. When the user clicks on the given link, it leads them to a page, displaying a picture of a multimedia player besides the opening text above. When the user clicks on the 'Play' button, the user is invited to download a binary file having name "StormCodec8.exe" or "StormCodec.exe". An unsuspecting user thinks that he/she needs to install this so called codec file to watch this video. A click on this file will make the user's PC part of storm club.

Click to read image

Ironically, this may be the very first time that storm's social engineering based campaign has used word "Storm". Storm is known for exploiting hot news and events to trick users. Here are some of the events and themes used by the Storm in year 2008 so far:

1. Happy new Year
2. Valentines Day
3. Funny eCards
4. April fool
5. Storm Codec

So what's next? Here is the list of remaining important events for year 2008. These events might be used as main themes for the Storm's next campaigns.

1. Memorial Day , May 26
2. Independence Day, Jul 4
3. Halloween , Oct 31
4. US Elections , Nov 4
5. Thanksgiving , Nov 27
6. Christmas , Dec 25
7. New Years Eve, Dec 31
8. Olympics , Summer 2008

Please note that in 2007 Storm has already exploited events such as Christmas, New Year, Halloween and Thanksgiving etc. This year US presidential elections look extremely vulnerable for Storm botnet misuse. Users must be very cautious while opening any unsolicited emails pointing them to these kind of web sites.

Atif Mushtaq @ Fireeye Malware Intelligence Lab

Comments/Questions to research@fireeye.com