Peed
Overview
Executive Summary
Peed (also widely known as the Storm Worm or Peacomm) was one of the most prolific and sophisticated botnets of the late 2000s. Originally appearing disguised as breaking news regarding a storm in Europe, Peed evolved into a massive, decentralized, peer-to-peer (P2P) botnet utilized by cybercriminals for massive spam distribution, Distributed Denial of Service (DDoS) attacks, and identity theft.Infection Vector and Technical Capabilities
The primary infection vector for Peed is massive spam email campaigns. The emails use high-pressure, topical social engineering (news events, fake e-cards, or invoice notifications) to trick the user into opening a malicious attachment or clicking a link to a drive-by download site. Once executed, Peed demonstrates advanced, highly resilient architecture:- Peer-to-Peer (P2P) C2 Infrastructure: Unlike traditional botnets that relied on a central C2 server (which could be easily taken down by law enforcement), Peed utilizes a decentralized P2P protocol (often Overnet). Infected machines communicate directly with each other to receive commands and updates, making the botnet incredibly difficult to dismantle.
- Aggressive Rootkit Evasion: Peed employs aggressive rootkit techniques (often utilizing `wincom32.sys`) to hide its files, registry keys, and active network connections from the user and traditional antivirus software. It actively attempts to disable local security services.
- Monetization (Spam and DDoS): The primary function of an infected node is to silently send massive volumes of spam (often pump-and-dump stock scams or pharmaceutical ads) or to participate in coordinated DDoS attacks against specific targets for extortion.
Threat Assessment
While the original Storm Worm botnet has largely been mitigated, the P2P and fast-flux DNS techniques it pioneered are still heavily utilized by modern malware. A Peed-style infection indicates a total compromise of the endpoint and places significant legal and reputational risk on the organization due to the machine's participation in global spam and DDoS operations.Remediation and Eradication
- Network Containment: Immediately isolate the infected machine from the network. Because the botnet relies on P2P communications, blocking standard P2P ports and monitoring for high volumes of outbound SMTP (Port 25) traffic is critical.
- Rootkit Removal (Bare-Metal Restore): Because Peed utilizes kernel-level rootkits, manual removal is highly unreliable. The only secure remediation is to completely format the hard drive and reinstall the operating system from a trusted image.
- Spam Blacklist Monitoring: If an infected machine successfully sent out spam, the organization's public IP address may be added to global DNS-based Blackhole Lists (DNSBLs), disrupting legitimate corporate email delivery.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1090.002 T1014 T1498 T1568
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_PEED {
meta:
description = "Detects Peed (advanced_threat)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "peed" ascii wide nocase
$s2 = "trojan.peacomm" ascii wide nocase
$s3 = "worm.storm" ascii wide nocase
$s4 = "win32/peed" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Peed Activity
id: 86e2ef41d85017acb2d37dafa03ffaf6
status: experimental
description: Detects generic indicators of the peed malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*peed*"
- "*trojan.peacomm*"
- "*worm.storm*"
- "*win32/peed*"
condition: selection
level: mediumReferences & External Analysis
- Search "peed" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Peed Advanced_Threat from Windows?
Manual removal of Peed is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Peed a virus or a Advanced_Threat?
Peed is classified as a Advanced_Threat. Unlike traditional viruses that infect files, modern malware like Peed typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Peed infection?
Symptoms of Peed can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: advanced_threat)
Explore other malware families in the same category:
Protect Your Network Against Advanced_Threats
Want to prevent Peed and similar threats from compromising your organization? Read our comprehensive defensive guide: Suspect an Infection? What to do.
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/peed.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.