May 2007 Malware Review
The 'Darling Buds of May' have now finished blossoming and we are almost halfway through 2007, now that 'Flaming June' is upon us.
Once more on the malware and related security threats front it has been an interesting month with another load of malware using social-engineering to get the victim to infect their computer without the need for the malware author to have to code routines to automate infection. We've also seen lots of activity from scammers and cyber-criminals again, more on that later.
Like previous months, I will cover some statistics from my own sensors and compare those against those from a couple of major anti-virus companies, and finally I will cover new and interesting things that occurred during the month.
I have created some graphs and performed some trend analysis from the raw data from my WormCharmer and Bayesian filter.
I have included four sources of information for the graphs and pie-charts, these are:
The last two are my own projects and all data is from the Internet, these systems are running on an aDSL link and are personal research projects that have been running for some time; WormCharmer 5 years, Malware Bayesian Filter 4 years.
In total I captured 800 samples during May, which have been catalogued as 35 distinct families and variants. In comparison during April I captured 736 samples which were catalogued as 40 distinct families/variants. As you can see the captures in May are very slightly up from April's total.
During May I captured and submitted no brand new malware strains/variants [unknown to all or most AV companies at the time of submission]. This is due to other work requiring my attention.
The May statistics further consolidate my view that the general trend is still downwards. It seems that social-engineering is still the technique of choice so far this year.
During Mayl I reported 70 new Phishing sites which are now included in the Netcraft phishing site database used by the Netcraft anti-phishing toolbar which I blogged about some time ago.
The first pie chart below shows the Top 10 distinct malware by percentage. Let us look at this in more detail:
W32/Tenga.3666 [Frisk] has consolidated the pole position it took back last month after after having to settle for the runner-up position during March when W32.Kasper.A [aka MyWife.D] had forced its way to the top of the chart. In contrast to Tenga, W32.Kasper.A has completely fallen out of the top ten in May along with W32.Sality.AD which grabbed the final podium place, in third.
So, because of that we have two members of the Opaserv.worm family [ae which is up 3 places and d which is a re-entry] in second and third places respectively.
There are five other members of the Opaserv.worm family in May's chart, up from just three representatives in April's chart. These are variants ah, ai, I, ac and k in fifth, sixth, seventh, eighth and ninth places respectively. Quite a turn-around in fortunes for this family!
Other casualties in May's chart include: IRC.Zapchast, Virus.Win32.Virut.a, W32/Netsky.P and Zhelatin.cq.
The last two places are claimed by Trojan-Downloader.Win32.Agent.bjo which a new entry, straight in in fourth place and W32.Dupator which is a re-entry back in the chart in tenth place.
If you compare the above to the data from Kaspersky and also the data from SOPHOS you may see some marked differences. Why? Well, simply my sample capture systems collect data from multiple 'vectors' and combine the data, so I tend to get a more rounded picture of what is really running round the Internet in the way of net nasties.
As you can see the top 10 from Kaspersky [below] for May still has Mytob.c in seventh place which it managed to climb to in February, it seems to have setup home there.
Netsky.q has regained the runner-up spot it held in March and lost in April. It is joined by three other family members, these being: Netsky.aa, regained the sixth place it claimed in March after falling down to eighth spot in April. Netsky.t, February's pole sitter which slipped down to fourth during March is back as the pole sitter in first place in May, and finally Netsky.b is has slipped one place from ninth to tenth.
Bagle.gt has reversed its slow journey down the chart, climbing back up the chart one place from fourth to third. Worm.Win32.Feebs.gen has also climbed up one place from sixth to fifth place.
We have two new entries in May's chart, these are: Email-Worm.Win32.Sober.aa straight in the chart in fourth place and Trojan-Downloader.Win32.Agent.bqs four places below it in eighth place.
To complete the top ten, we have Scano.gen which has managed to climb one place from tenth to ninth place.
Kaspersky had this to say about May's chart:
"A first look at the top of the table for May might give the impression that we've slipped back in time to the end of 2005. You can rub your eyes as hard as you want but it won't change anything - Netsky, Bagle and Sober are topping the rankings again, just as they were a few years ago. "
Please note: SOPHOS are now effectively only using family names for their top ten malware and because of this I will now use the same method for analysing their data.
In the SOPHOS chart we see a different pattern; Netksy has finally lost its grip on pole position during May and we have a new pole sitter, this being Sober, which is a re-entry into the top ten.
Here is some commentary on it from Sophos:
"In May, Sober was the most prevalent email-borne attack, toppling Netsky from its top position and accounting for almost one third of all threats. Sober's dominance in the chart is primarily due to a huge outbreak on May 1st that coincided with May Day across Europe. During this 24-hour period, Sober accounted for nearly 70 percent of all infected email identified by Sophos."
Zafi-D which dropped from February's fourth to sixth place in March and which reversed its slide down the chart, ending up in fifth place in April is on the slide again, slipping down one place to sixth in May.
Meanwhile Nyxem.D [aka MyWife] has dropped another place in May; down from ninth to tenth place.
Stratio-Zip has consolidated its grip on fourth place, after falling out of the chart in February and Mytob has dropped likewise remained static in third place, which it grabbed back in December 2006.
Mydoom which was a re-entry in November's chart has recovered some ground after falling to seventh place in April; it is now up two places to fifth. November's new entry, Sality has lost one more place in May, down from sixth to joint seventh place in May's chart.
We have just one new entry in May's chart, this being Mal/Behav sharing seventh place with Sality.
To complete this month's top ten Bagle drops a single place from eighth to ninth place.
The final pie chart below shows the Top 10 malware families trapped by percentage. As you can see this includes not only mass-mailers but also share-crawling worms and bots. This month the table is once more headed up by the September 2005 leader, Tenga. March's new 'pretender', W32/Kasper [aka MyWife] which stole Tenga's crown in March has completely disappeared from the chart in May.
Mytob has dropped out of the chart during April from the sixth spot it held during March. Opaserv has managed to climb one place from the final step on the podium up to the runner-up spot; second.
Zapchast which stormed up the chart from ninth to fifth place in February and managed to move up to fourth place in March has fallen on hard times after slipping down to eighth place in April it has lost more ground and slides down one more place to ninth. Netsky is static in fifth place.
We have two re-entries in May, these are: Email-Worm.Win32.Warezov and W32.Dupator in fourth and sixth places respectively.
One of March's new entries, Virut has consolidated its hold on seventh place in May's chart. Talking of new entries, we have three in the top ten for May, these are: Trojan-Downloader.Win32.Agent, Trojan-Spy.Win32.Banker and Trojan.BAT.Runner.b coming into the top ten in third, eighth and tenth places respectively.
If you wish to see the current top 10, then see my external website at http://momusings.com. The data which feeds the WormCharmer stats is updated every 3 minutes 24 hours a day.
Please feel free to ask questions if you need any clarification on the data, the setup or whatever.
Now, let's switch to a different method: The following graph shows the percentage of malware that I received and my Bayesian Filtering tool classified correctly. You can see the data for the whole of the period of 2005 - 2007 [up to the end of May] here. This clearly shows that May was the quietest month since I started keeping these statistics. As shown in the figures for May, the overall trend is still downwards and that we will continue to see less malware being seeded via e-mail although we may continue to see more malware being seeded via links in e-mails, rather than as attachments, such as fake e-cards.
The raw statistics (both CSV and Graphed) can be found in the usual place on my site. If you feel you need access then please contact me to discuss.
If we look at the overall growth of malware in 2007, it grew from 222,473 [as at the end of 2006] to 265,284 at the end of May. That's a growth of 42,811 new malware strains and/or variants in the first five months of 2007, in May the number jumped by 12,126. If I extrapolate this my guesstimate for the growth in malware in 2007 would be just over 102,700.
Things have certainly speeded up during April and May!
What's New?
Instead of including commentary here about things I have already written about, I will offer links to other blog entries that may be of interest, topical, or cover some of the interesting occurrences in May 2007.
Conclusions:
The current trend of using social-engineering which has been widespread in January - April has continued in May, as seen by continuing high numbers of fake e-cards notifications being trapped.
We have seen an unexpected recovery in the level of spam in May this may have dented the figures for both 419s and Malware arriving via e-mail, only time will tell.
The phishers have been busy both with new versions of their scams, but also trying to recruit new 'staff' to launder the proceeds of their criminal activity. It seems that they have more material [stolen accounts/credentials/credit card data] than they can handle, which is both gratifying [as they can't deal with more than a percentage of what they have acquired] and worrying [that they have managed to amass so much personal/financial data in the first place].
Links:
- Virus Top Twenty for May 2007 [Kaspersky]
- Top ten viruses and hoaxes for May 2007 [Sophos]
posted by Martin @ 13:35
0 Comments
