Nuwar Isn’t Fooling Around
Monday March 31, 2008 at 11:27 am CST
Posted by Dmitry Gryaznov
In “celebration” of tomorrow being April Fool’s Day, the people behind Nuwar a.k.a. Storm have launched a new E-mail spam campaign. An E-mail with a subject and a short body text like “Happy April Fool’s Day!” or similar would have a usual, for Nuwar anyway, all-numeric-IP http link. Following that link brings up a page like this:

If you wait those 5 seconds, it’ll try to download file funny.exe to your computer. If you click on the image, it’s kickme.exe. And if you click on “click here” it’s foolsday.exe. All of them are nothing but a new Nuwar variant.

March 31st, 2008 at 1:09 pm
i already got it .. it was in my spam box
##mail##
# from: belladama@[removed].com.br
# sub: Gotcha! April Fool!
#
# Doh! All’s Fool. http://xxx.yyy.zzz.aaa
i must say very innovating
PS i didnt downloaded the .EXE file
April 1st, 2008 at 10:38 pm
I received the mail on March 31, did download the .EXE file on April 1 to check if it would be recognized by McAfee. Yesterday it wasn’t recognized, but today, on April 2 with dat 5264.0000 the downloaded file has been deleted…