As many of you already probably know the Waledac Botnet Social Engineering theme changed to a “SMS Spy on your Partner” theme at approximately 0500 CST or 1000 UTC/GMT on April 15th.  This was first brought to my attention by Bob Burls from Cranfield University in the UK, and he was also kind enough to share with me this screen shot of the new campaign.

Thanks Bob for the screen shot and the information!

Interesting enough this theme is very similar to the “Couponizer Theme” we saw in late February, as it is a spoof from a legitimate company’s web site.  The image and theme are based off the SPY-SMS website, which appears to offer mobile phone spy software.

I pulled a few interesting statistics from my database and thought I would share them with everyone.  Over the last 30 days the Waledac Botnet infections appear to be very steady or normalized, as there are very little differences in the number of new infections found by my Waledac Tracker scripts depicted here:

New Infections By IP Count Last 30 Days

In comparison here is a table of the most active days by new IP counts:

Most Active Days By New IP Counts

Another interesting statistic I pulled was the number of unique binary names seen every day for the last 15 days:

Unique Binary Name Counts for Last 15 Days

As you can see these stats look fairly normalized or evenly distributed.  As a comparison here is the top five dates with counts for the number of unique binary names seen in one day:

Top 5 Dates By Unique Binary Name Counts

As you can see the “Couponizer Theme” campaign during the end of February consisted of a larger variation of binary names, when compared to the last two campaigns.

The last statistic I am going to post is the number of IPs that were last seen by my Waledac Tracking scripts in the month of April.

Number of IPs By Last Seen Date Counts for April

For a comparison here are the most active last seen days in my database.

Most Active Last Seen Dates By IP Count

Looking at this last table I would assume that during the end of January and beginning of February the Waledac Binary was well detected by Antivirus Companies, as it looks like a number of systems were cleaned up during that time period.  Now these statistics may or may not show the true depiction of the Waledac Bots, as I am crawling the Bots that have public IP addresses and not the Spamming Bots with NATed IP addresses.