Intelligence Note

Prepared by the Internet Crime Complaint Center (IC3)

December 15, 2006

New virus identified: Warezov/Stration worm

The FBI has become aware of a worm identified as Warezov/Stration Worm circulating as a spam e-mail quickly and effectively across the Internet. The spam e-mail claims the e-mail recipient's computer/IP address has been identified for malicious activity online. An attachment to the e-mail is purportedly a software used to clean the recipient's machine. This attached executable is the Trojan downloader portion of the worm itself.

A worm is identified as a program that duplicates itself over a computer network and typically performs malicious actions.

This worm or virus is unique in the quickness in which it is spreading. Upon infection, a machine will download and install a number of executables. Once the executables have been installed, an infected machine will begin conducting Domain Name Service (DNS) queries to look for open mail proxies. The infected machine then begins spamming mail containing a social engineering attack along with a Stration trojan downloader attachment.

If you receive a suspicious e-mail with a file attached, do not download the attachment associated with the e-mail. If you receive this e-mail or an e-mail similar to this, delete the message and do not open the attachment.