"Hey, take a look!!" / "Yahoo Daily News"

Looks like another variant of the Storm Worm /Zapchast doing the rounds:

Subject: Hey, take a look!!
From: "Yahoo Daily News"

Hello friend !
You have just received a yahoo messenger ultimate version !!


Click Download Now to begin downloading and installing Yahoo Messenger ultimate version 10 ver 10.1



1. Download Now Click Download Now to begin downloading and installing Yahoo! Messenger ultimate version 10.
ver. 10.1
2. When prompted, please click the Run button in each window that appears.

Other versions: XP (9.0 Beta), Vista, Mac, Web, Mobile

Thank you for using our services !!!
Please take this opportunity to let your friends use about this new software by sending them the source.

Copyright © 2008 Yahoo! Inc. All rights reserved. Copyright/IP Policy | Terms of Service |Guide to Online Security

Relevant advertising creates a better web experience. See how

NOTICE: We collect personal information on this site.

To learn more about how we use your information, see our Privacy Policy

In this case the target file to download is msgr8.5us.exe, VirusTotal detection is pretty good.

Expect to see a LOT of these over the next few days, either themed for the Olympics or the war in South Ossetia. Although the subject will always change, a crash course in user education can help to mitigate the risk.

Very authentic looking Hallmark ecard trojan

A very authentic (but fake) trojan was send out overnight purporting to be from Hallmark.com

A Friend has sent you a Hallmark E-Card.

If you recognize this name, click the link to see your E-Card.
http://www.hallmark.com/ECardWeb/ECV.jsp?a=[snip]


If this name is not familiar to you and you're concerned about online security, please use the following steps:

1. Visit http://www.hallmark.com/getecard
2. Enter your e-mail address in the Original Recipient.s E-Mail Address box.
3. Enter EG0694262772475 in the Confirmation Number box.
4. Click Display Greeting.

Want to send an E-Card too ? Visit www.hallmark.com/ecards



To view Hallmark’s privacy policy or for questions, visit www.hallmark.com, and click the links at the bottom of the page.

The displayed links are all safe, however the FIRST link actually points to hxxp:||pop.ayudaenaccion.org.sv|card.exe



VirusTotal detection is not bad.

Files loaded are as follows:
%systemroot%\system32\nicks.txt
%systemroot%\system32\remote.ini
%systemroot%\system32\script.ini
%systemroot%\system32\servers.ini
%systemroot%\system32\sup.bat
%systemroot%\system32\sup.reg
%systemroot%\system32\users.ini
%systemroot%\system32\aliases.ini
%systemroot%\system32\control.ini
%systemroot%\system32\explorer.exe
%systemroot%\system32\mirc.ico
%systemroot%\system32\mirc.ini


Payload is Zapchast, basically it tries to join the machine to an IRC controlled botnet.

Added:
The remote.ini it drops onto your machine has some interesting host names you might want to block and/or investigate:

[users]
n0=100:*!*@lamerzkiller.users.undernet.org
n1=100:*!*@209.43.75.13
n2=100:*!*@estranho-colo.iquest.net
n3=100:*!*@OMGyouSUCK.users.undernet.org
n4=100:*!*@CoReCt.users.undernet.org
n5=100:*!*@hxr.users.undernet.org
n6=100:*!*@BebiDeea.users.undernet.org
n7=100:*!*@asdz.users.undernet.org
n8=100:*!*@ZmAu.users.undernet.org
n9=100:*!*@ReKt.users.undernet.org
n10=100:*!*@BebeDulce.users.undernet.org
n11=100:*!*@ReCt.users.undernet.org
n12=100:*!*@hacler.ro
[variables]
n0=%HAck1 #GangstaRap | #:">
n1=%console
n2=%utime 1205420752
n3=/away :sã îmi suge-ti cuca zdrentzelor !
n4=%ochan #GangstaRap | #:">