Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: New Worm making the rounds? SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
New Worm making the rounds?
We've received a bunch of emails in the past few minutes indicating the possible presence of a new Worm.

Apparently it indicates itself as a "Patch" for the "New worm" that is going around (whatever that may be, there are just so many I could choose from!)

The Subject of the email (that we have seen so far) says "Worm Alert!".

It has two attachments, one being an image with "panic-worded text", andt he other is a password protected zip file, whose password is revealed in the image.

Clamav will not pick up the zip file, but it will pick up the .exe inside of it, and apparently names it "Trojan.Small-1641"  (That's so descriptive!)

Joel Esler
Handler of the Day

454 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!