Malware reports

Malware Miscellany, July 2008

  1. Greediest Trojan targeting banks
    This month, the winner is a modification of Trojan-Spy.Win32.Bzub.bvq – it’s quite modest in its ambitions, targeting a mere 36 banks, a relatively low number for malware in this category.

  2. Greediest Trojan targeting payment systems
    Trojan-Banker.Win32.Banker.qhq targets three payment systems simulaneously

  3. Greediest Trojan targeting payment cards
    Trojan-Spy.Win32.Banker.qdo targets three payment card systems – exactly the same number as its close relative in the previous category

  4. Stealthiest malicious program
    July’s nomination in this category was taken by Backdoor.Win32.Hupigon.cqzq – notwithstanding the program being packed seven times, it still got added to our antivirus databases

  5. Smallest malicious program
    In July, Trojan.BAT.KillWin.vx demonstrated its dislike of Windows by using its 36 bytes to delete winlogon.exe, a system file.

  6. Largest malicious program
    The 203MB of Trojan-Win32.Haradon.ga, this month’s winner, were spread in the guise of a screensaver.

  7. Most common vulnerability on the Internet
    The category ‘Most malicious program’, a fixture in previous Miscellanies, is no longer particularly indicative of the malware landscape. So this month we’ve introduct a new category – ‘Most cmmon vulnerability on the Internet’, i.e. the one most exploited by malicious users. This month the victory goes to Trojan.Clicker.HTML.Iframe.sy, which makes up more than 12% of all vulnerabilites found on web pages used by malicious users to infect victim machines.

  8. Most common malicious program on the Internet
    The category ‘Most common malicious program in email traffic’ has also changed. Readers of this column may remember that the winner of that nomination remained unchanged over several months. In order to give a more representative picture, this cateogory is now called ‘Most common malicious program on the Internet. Trojan.Win32.Agent.sav wins out in July, as it was involved in 5.52% of all attempts to infect users.

  9. Most common Trojan family
    Trojan-Downloader.Win32.Zlob makes an appearance this month, with a relatively low 1217 modifications.

  10. Most common virus/ worm family
    This category again features Worm.Win32.AutoRun with another 126 new modifications in July.

Malware Miscellany, July 2008

Your email address will not be published.

 

Reports

The SessionManager IIS backdoor

In early 2022, we investigated an IIS backdoor called SessionManager. It has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East.

APT ToddyCat

ToddyCat is a relatively new APT actor responsible for multiple sets of attacks against high-profile entities in Europe and Asia. Its main distinctive signs are two formerly unknown tools that we call ‘Samurai backdoor’ and ‘Ninja Trojan’.

WinDealer dealing on the side

We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack.

APT trends report Q1 2022

This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q1 2022.

Subscribe to our weekly e-mails

The hottest research right in your inbox