SlapperII.A aka Slapper.D variant
The SlapperII.A variant was first detected on or around 2002/09/28. As of 2002/10/01 07:30, there were over 1500 systems infected with the SlapperII.A variant. This worm retrieves the majority of its payload from a web server. The orginal web server used (220.127.116.11) was blocked/cleaned on 2002/09/30. On 2002/10/01, a modified SlapperII.A worm was found that now retrieves its payload from http://www.rmna.org (18.104.22.168).
Internet Storm Center has the analysis.
[ Read more ]
- News: Honeymoon over for Linux users (1 October 2002)
- Virus News: Arrest for Slapper Worm Author (24 September 2002)
- Virus News: ISS Alerts on Slapper Worm Modification (23 September 2002)
- News: Slapped Silly (20 September 2002)
- Virus: Worm.Linux.Slapper (18 September 2002)
- News: Security experts divided on Slapper's threat (17 September 2002)
- News: Linux worm hits the network (16 September 2002)
- Virus News: Reverse Engineered Slapper Worm (16 September 2002)
- Virus News: F-Secure Warns About a New Linux Worm (16 September 2002)