The Nuwar.B worm aims to drive up stock market prices

Panda Software has detected the presence of emails containing Nuwar.B, a new variant of the Nuwar family of worms. This malicious code uses the New Year as a ruse to infect computers. This is not a malicious code designed to cause an epidemic or damage computers but to artificially drive up certain prices on the stock market.

Nuwar.B reaches computers in a message with the subject “Happy New Year!” The message text is blank, and includes a file with the name postcard.exe, which contains the worm. Also, to gain credibility, it spoofs the sender’s address, pretending to come from various users.

If the target user runs the attached file, Nuwar.B copies itself to the system and downloads a copy of the Spammer.EN Trojan to the computer. The Trojan then connects to certain email servers to send out spam to the addresses it finds on the affected system. This particular spam contains information to convince users to buy certain stocks to increase their price rapidly.

It appears that the creator(s) of Nuwar.B have sent out the worm as spam, manipulating certain email servers in an attempt to distribute it as quickly as possible.