Presentation on the Storm Worm

Thorsten Holz from the Honeyblog published a presentation on the Stormworm which might be worth looking at (there is some interesting information on how it communicates):

The presentation is now available. It provides an overview of Storm Worm and highlights various aspects of the botnet. The presentation is an extended version of our LEET'08 paper on the same topic.

Storm is still an interesting botnet. However, the botnet is getting smaller and smaller - nowadays there are typically less than ten thousand machines online during a typical day. Seems like the good ol' days of Storm are over... (Source: Honeyblog)

Related articles:

• Storm Worm gets downsized but is coming back with a vengeance
• Kraken bot dissected and some related tools
• Storm Worm posing again as video codec
• April Fool's Day is newest theme for Storm Worm
• Storm Worm/Nuwar is beginning a new wave
• Update New kid on the block: Mega-D overtakes Storm Worm