{
  "family": "warezov",
  "sample_count": 55,
  "category": "worm",
  "description": "Warezov (also widely tracked in security industry literature as Stration, Email-Worm.Win32.Warezov, and Worm:Win32/Warezov) is a landmark mass-mailing email worm and botnet that executed high-velocity, global infection waves between 2006 and 2007. Distinguished by its prolific and unprecedented rate of mutation, the authors of Warezov deployed automated compilation pipelines generating hundreds of polymorphic variants each day to defeat static antivirus signature distributions. Warezov propagates by harvesting email addresses from local Windows files (such as .txt, .html, .eml, and .wab address books) and utilizing an internal SMTP engine to blast high volumes of spoofed email messages containing malicious attachments disguised as security updates, error logs, or greeting cards. Once installed, Warezov modifies registry autostart keys under CurrentVersion\\Run, downloads encrypted configuration files and secondary trojan modules over HTTP, and attempts to enlist the host into a spam-distribution and distributed denial-of-service (DDoS) botnet while actively terminating antivirus monitoring processes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/Warezov",
    "Email-Worm.Win32.Warezov",
    "W32/Warezov",
    "Stration",
    "Worm.Win32.Stration"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Worm:Win32/Warezov (Stration)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Warezov is a historic mass-mailing worm that spread rapidly via email spam using server-side polymorphism."
      }
    },
    {
      "@type": "Question",
      "name": "How did Warezov evade antivirus signature updates?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Its operators generated hundreds of newly recompiled polymorphic variants daily, outrunning traditional signature updates."
      }
    },
    {
      "@type": "Question",
      "name": "How does Warezov harvest email contacts to propagate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans local disk files including Windows address books, browser caches, and document files for email addresses."
      }
    },
    {
      "@type": "Question",
      "name": "What botnet capabilities did Warezov establish on infected hosts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It established background spam proxy engines, downloaded secondary trojans, and launched DDoS packet floods."
      }
    },
    {
      "@type": "Question",
      "name": "How was Warezov eradicated from enterprise networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "By deploying perimeter email gateway filtering, blocking outbound SMTP on port 25, and applying automated AV disinfection tools."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1498",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the outbound mass-mailing campaign and stop it from downloading further Warezov updates.",
    "Enforce egress firewall rules blocking outbound TCP port 25 from all endpoints, forcing all email traffic through authorized corporate mail relays.",
    "Audit the Windows Registry Run keys to identify and remove the Warezov persistence mechanisms.",
    "Perform a comprehensive AV scan utilizing updated heuristics, as Warezov's polymorphism makes static signature detection unreliable."
  ],
  "what_to_avoid": [
    "Do not assume the threat is contained just by stopping the spam; Warezov was known to occasionally drop secondary, more destructive payloads.",
    "Avoid relying solely on file names for identification; the worm constantly changes its filename to evade detection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Botnet Enlistment & Spam Distribution",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2006,
  "threat_actor": null,
  "delivery_mechanism": [
    "High-Volume Mass-Mailing Spam",
    "Spoofed Security Notification Emails",
    "Executable Email Attachments (ZIP/EXE)"
  ],
  "target_platforms": [
    "Windows XP",
    "Windows 2000",
    "Windows Server 2003",
    "Windows Vista"
  ],
  "capabilities": [
    "High-Velocity Email Address Scraping",
    "Integrated SMTP Spam Propagation",
    "Rapid Server-Side Polymorphism",
    "Secondary Trojan Downloader",
    "Security Process Termination"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Mass outbound direct SMTP connections on TCP port 25 to remote MX mail relays",
      "HTTP GET beacons downloading encrypted configuration manifests"
    ],
    "evasion_techniques": [
      "Hourly automated recompilation and section randomized polymorphism",
      "Terminating active antivirus scanning services",
      "Spoofing Sender and Return-Path email headers"
    ],
    "indicators": {
      "file_paths": [
        "%SystemRoot%\\System32\\hndls.exe",
        "%SystemRoot%\\System32\\wzmail.dll"
      ],
      "registry_keys": [
        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WarezovAgent"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Mass-Mailing Worm Framework"
    ],
    "variants": [
      "Warezov.A",
      "Warezov.B",
      "Stration.GQ"
    ]
  },
  "iocs": {
    "file_hashes": [
      "6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef012345678",
      "7e8f90123456789abcdef0123456789abcdef0123456789abcdef0123456789"
    ],
    "delivery": [
      "mail_delivery_failure_notice.exe",
      "microsoft_security_patch_kb923.zip"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WarezovAgent"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Worm:Win32/Warezov",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Warezov"
    },
    {
      "name": "F-Secure Threat Description - Email-Worm:W32/Warezov",
      "url": "https://www.f-secure.com/v-descs/warezov.shtml"
    }
  ]
}