Latest Stormworm sharing Labor Day greetings

The CME-711 (Stormworm) peers are now spreading windows executable files with the following names:

file.php, video.exe, setup.exe, sony.exe and labor.exe

Sony.exe and labor.exe are new over the last 48 hours. Be sure to update your IDS Signatures.

Labor.exe is in reference to the Labor Day holiday:

Our Greeting System has a Labor Day card for you, go here to pick it up:

http:// yahoo.com /07cards/ greet1?[random hex string]

We're getting a new file on each download attempt again:

413801f06694ad17a7fa03508317fdac labor.exe
4f69c5550a497a02e0f690945925f398 labor.exe
024bf16416645df65358777b214d7997 labor.exe
2aa54149fcfc7ebaa960a8d5648d7dbb labor.exe
6cd2ed30fc3653f241b0702ef4c6f3c6 labor.exe
95b57c8cf2022317aafca06dae2d14be labor.exe
352cf8ef2bbca763d2d03e83fb86c9fd labor.exe
781e08a5dcc2c53646ed097e533d6659 labor.exe
accc4e975b8ab70b4286d113fe5e09dc labor.exe
7375b5c6614cf1a24713949a2ea9800a labor.exe
d43611911af1f7a2401faab91214c2bc labor.exe
cbe59b6688925857ab76301ce61919e5 labor.exe
0b9b061d368763ab51bf6d78f3c36086 labor.exe
651709024ebb9b830fdb9fca161348ae labor.exe

Our MD5 list has been updated, identifying the 26,200+ binaries we've captured. You can view it here.