Storm continues its holiday run, now making its presence felt with New Year-themed messages.
According to Trend Micro Senior Threat Analyst David Sancho, the spammed messages contain a link that redirects to certain IP addresses in order to download a file named happy2008.exe. Below is a screenshot of one of the malicious pages:
The page reads: “Your download should begin shortly. If your download does not start in approximately 15 seconds, you can click here to launch the download and then press Run. Enjoy!”
“(The affected IPs) look like a redirecting download site,” David says. “But if you visit (them) with an outdated browser, you get automatically infected.”
Similar to the previous Christmas spam run, Trend Micro detects the downloaded file as WORM_ZHELATI.AIS.
The usual warnings apply — be careful of email messages that contain suspicious links, etc.