IM malware tries a new approach

We’ve recently received several inquiries regarding a certain worm.
At first glance, this worm didn’t seem to have any new features. The combination of spreading via P2P and IM is not new at all.

When I had time to investigate further, I noticed something interesting.
Instead of relying on ‘real’ webservers, this malware simply turns the infected machine into a webserver.
The biggest advantage this approach has is the fact that the host is fairly unlikely to be shut down quickly.

As you can see from the description the worm connects to a specific server to determine the computer’s (outside) I.P. address.
Most likely this is done to circumvent the problem of internally used I.P. addresses on computers, such as the 10.x.x.x and the 192.168.x.x ranges.

This is an interesting new approach. But for it to be effective, machines within a LAN will have to have the necessary portforward in place, and I’m not sure that this is widespread. We’ll keep you posted on any developments.