March 2007 Malware Review
Just about managed to get this finished before the end of the month.
March has come and gone and already we have used up the first quarter of the year. However, some things don't change; it has been another very busy month for me. On the malware and related security threats front it has been an interesting month with yet more mass-mailing malware, which many anti-virus firms were saying would be extinct by now, guess again! We have also seen an awful lot of malware using social-engineering to get the victim to infect their computer without the need for the malware author to have to code routines to automate infection.
Like previous months, I will cover some statistics from my own sensors and compare those against those from a couple of major anti-virus companies, and finally I will cover new and interesting things that occurred during the month.
I have created some graphs and performed some trend analysis from the raw data from my WormCharmer and Bayesian filter. I have included four sources of information for the graphs and pie-charts, these are:
The last two are my own projects and all data is from the Internet, these systems are running on an aDSL link and are personal research projects that have been running for some time; WormCharmer 5 years, Malware Bayesian Filter 4 years.
In total I captured 638 samples during March, which have been catalogued as 38 distinct families and variants. In comparison during February I captured 894 samples which were catalogued as 43 distinct families/variants. As you can see the captures in March are significantly down from February's total.
During March I captured and submitted 1 brand new malware strains/variants [unknown to all or most AV companies at the time of submission].
The March statistics further consolidate my view that the general trend is still downwards. It seems that social-engineering is the technique of choice so far this year.
During March I reported 58 new Phishing sites which are now included in the Netcraft phishing site database used by the Netcraft anti-phishing toolbar which I blogged about some time ago.
The first pie chart below shows the Top 10 distinct malware by percentage. Let us look at this in more detail:
W32/Tenga.3666 [Frisk] had to settle for the runner-up position during March, as W32.Kasper.A [aka MyWife.D] forced its way to the top of the chart ousting February's pole sitter in the process by less than half a percentage point. Bear in mind that W32.Kasper.A wasn't even in the top ten in February, so it is a re-entry, which makes its position in March's chart even more incredible.
Mytob.J, which was the runner-up in February's chart and seriously threatening Tenga's hold on pole position, has slipped down the chart to sixth place.
The share-crawling worms which suffered a decrease in their numbers from seven of the ten slots in August to just four in September, October and November 2006, fell on hard times in January and February only managing to fill one place in the chart, the survivor was Tenga.3666. What a difference a month makes, the Opaserv.worm family which completely failed to turn up in the chart in February, is back. Not just one or two, but four representatives are back in the top then. These are variants ae, d, ac and ai, in fifth, seventh, ninth and tenth places respectively.
IRC.Zapchast has managed to climb up the chart from the final slot in January's chart, stealing fourth place in February and finally climbing one place to third in March's chart.
A new entry in March's chart [in 4th place] is Virus.Win32.Virut.a which is a bit of a throw-back, being a real 'virus', an appending one, as well as being a Bot. We also have another new entry, even though it is a real oldie [Pate.B in 8th place], as it has been around for a long time but never managed to get in to the top ten, until now.
If you compare the above to the data from Kaspersky and also the data from SOPHOS you may see some marked differences. Why? Well, simply my sample capture systems collect data from multiple 'vectors' and combine the data, so I tend to get a more rounded picture of what is really running round the Internet in the way of net nasties.
As you can see the top 10 from Kaspersky [below] for March still has Mytob.c in seventh place which it managed to climb to in February, up from ninth in January.
Netsky.q has managed to climb back up to the runner-up spot in March, having fallen down the chart from second place in January to fourth in February. It is joined by three other family members, these being: Netsky.aa, which recovers its sixth place from the drop to tenth it suffered in February, Netsky.t, February's pole sitter slips back down to fourth and Netsky.b is a re-entry in at ninth place.
Bagle.gt continues its slow journey down the chart, slipping one place to third.
As seen in my own top 10 chart, the Zhelatin family which stormed the Kaspersky chart during February have disappeared from the top ten just as fast as they arrived.
We have three new entries in March's chart, these are: Bankfraud.ra straight in the chart in pole position, Warezov.jx in at fifth place, and to complete the top ten, we have Scano.gen a new entry in at eighth place and Mydoom.l which is a re-entry taking the final place; tenth spot.
Kaspersky had this to say about March's pole sitter:
"This month's leader, Trojan-Spy.HTML.Bankfraud.ra is also the result of recent virus epidemics. This Trojan is a typical phishing email, and millions of copies have been sent around the world. We've also noticed that this malicious program has been mass mailed several times. Bankfraud.ra was first detected on 27th February 2007, and in the space of a single month reached such a volume that this month it accounts for more than 30% of all malicious programs detected in mail traffic.
The Trojan targets clients of the Branch Banking and Trust Company (BB&T). It attempts to lure them to fake web sites registered by their undoubtedly malicious users in Croatia and the Cocos (Keeling) Islands."
In the SOPHOS chart we see a different pattern; Netksy.p has once more raised its game and stolen pole postion once more in March. Fenruary's pole position sitter, HckPk has completely dropped out of the top ten.
Here is some commentary on it from Sophos:
"Unwanted emails hiding copies of Netsky are still spreading like weeds in an untended garden, showing how well seeded these mass-mailing threats are," said Carole Theriault, senior security consultant at Sophos.
Zafi has dropped from February's fourth to sixth place in March. Meanwhile Nyxem.D [aka MyWife] has gained one place in March, up from ninth to eighth place.
Stratio has managed to claw its way back into the top ten, to seventh place, after falling out of the chart in February. Mytob has improved upon the third place it grabbed back in December 2006, and is up one place to be March's top ten runner-up.
Mydoom-O which was a re-entry in November's top climbs two places from sixth place to fourth and November's new entry, W32/Sality.AA has climbed another two more places from fifth place to third in March's chart.
The last remaining member of the Bagle family, Bagle-qw crawls further up the chart from seventh to fifth place.
To complete this month's top ten we have Clagger.a which is down one place from ninth to eighth spot and a new entry DwnLdr.GFX in at tenth place.
SOPHOS also noted the following:
"It's frustrating to think that there are a bunch of new threats out there that are much more targeted and devious in their approach, yet how can we expect the average computer user to protect against them when the Netskys and Mytobs remain so rooted? Users need to roll up their sleeves and commit to keeping their PCs secure both for their sake and the sake of everyone else connected to the web."
The final pie chart below shows the Top 10 malware families trapped by percentage. As you can see this includes not only mass-mailers but also share-crawling worms and bots. This month, surprisingly, the table is not headed up by the September 2005 leader Tenga. This month a new 'pretender' has stolen its crown in March, so Tenga has had to make do with the runner-up spot once more. This 'pretender' is W32.Kasper [aka MyWife].
Mytob has dropped from third place in February's chart to sixth spot during March
Zapchast which stormed up the chart from ninth to fifth place in February has managed to move up to fourth place in March. Opaserv has also climbed up the chart in March from sixth to the final step on the podium; third place.
February's new entries Parite [aka Pate] is static in seventh and Sality is up one place to ninth place respectively. New entries include Virut and Cloner in at fifth and eighth places respectively. Dupator completes March's top ten, in tenth.
If you wish to see the current top 10, then see my external website at http://arachnid.homeip.net. The data which feeds the WormCharmer stats is updated every 3 minutes 24 hours a day [barring power-cuts, internet connectivity issues or hardware faults].
Please feel free to ask questions if you need any clarification on the data, the setup or whatever.
Now, let's switch to a different method: The following graph shows the percentage of malware that I received and my Bayesian Filtering tool classified correctly. You can see the data for the whole of the period of 2005 - 2007 [up to the end of March] here. This clearly shows that March was slightly down on the December 2006 total and significantly down on the first two month of 2007. As shown in the March figures, I still believe that the overall trend is still downwards and that we will see less malware being seeded via e-mail.
The raw statistics (both CSV and Graphed) can be found in the usual place on my site. If you feel you need access then please contact me to discuss.
If we look at the overall growth of malware in 2007, it grew from 222,473 [as at the end of 2006] to 241,959 at the end of March. That's a growth of 19,486 new malware strains and/or variants in the first quarter of 2007. If I extrapolate this my guesstimate for the growth in malware in 2007 would be just under 78,000.
What's New?
Instead of including commentary here about things I have already written about, I will offer links to other blog entries that may be of interest, topical, or cover some of the interesting occurrences in March 2007.
- A Police Website Line-up, Who's The Imposter? [March 12th, 2007]
- Bogus IE7 Being Spammed Out [March 30th, 2007]
Conclusions:
The current trend of using social-engineering which has been widespread in January and February has continued in March, as seen by the IE7 'fake' download detailed elsewhere in this report.
The re-emergence of mass-mailing malware has caught many anti-virus vendors off-guard, especially as many of them had claimed that mass-mailing malware was almost extinct. What I find more worrying is how successful these new ones have been because of the use of social engineering. This clearly shows that 'typical-users' are still the weakest link in security. Many are still using anti-virus tools as a sort of authorisation/access-control tool and taking risks opening attachments, they know they shouldn't, because they believe that the technology in place will save them and if it doesn't it isn't their fault.
Links:
- Virus Top Twenty for March 2007 [Kaspersky]
- Top ten viruses and hoaxes for March 2007 [Sophos]
posted by Martin @ 16:14
0 Comments
