Malicious programs detected on users’ computers
The first Top Twenty list immediately below shows malware, adware and potentially unwanted programs that were detected and neutralized by the on-access scanner when they were accessed for the first time.
|Position||Change in position||Name||Number of infected computers|
During May there were five new entries to the list.
Variants of the CVE-2010-0806 exploit left the Top 20 list as swiftly as they had joined it a month ago. However, malware writers are nowhere near through with exploiting the CVE-2010-0806 vulnerability. In May, Trojan.JS.Agent.bhr, a component of one of the CVE-2010-0806 exploit versions, moved up nine places to take up 5th position. The newcomer, Trojan.JS.Iframe.lq (13th place) is nothing but an intermediate link of a drive-by attack: it is used to redirect the user to Exploit.JS.CVE-2010-0806.i. Another piece of malware with a direct relationship to the CVE-2010-0806 vulnerability is Trojan.JS.Zapchast.dv. This Trojan is part of Exploit.JS.CVE-2010-0806.e which is currently in 20th place.
Trojan-GameThief.Win32.Magania.dbtv in 16th place lends support to the assumption that we made around a month ago concerning the purpose of the above exploits. Malware writers mainly use them to steal online gaming identities. This particular credential thief has impacted players of CabalOnline, Metin2, Mu Online and various games developed by Nexon.net.
The general scheme of infection is as follows:
- The user first visits a website contaminated by Trojan.JS.Iframe.lq, Trojan.JS.Zapchast.dv or either of the two versions of the CVE-2010-0806 exploit.
- The exploit then downloads Trojan-Downloader.Win32.Geral.cnh. This is a Trojan downloader that packs a pretty massive payload. Its malicious arsenal includes: two rootkits to help it hide from any security software; the Worm.Win32.Autorun component to ensure that the Trojan can propagate via detachable memory devices, and a download algorithm to allow the cybercriminals to use to-download lists.
- The Geral component downloads various versions of Trojan-PSW.Win32.QQPass, Trojan-GameTheif.Win32.OnlineGames/WOW/Magania, including Trojan-GameThief.Win32.Magania.dbtv, to the victim computer.
Malicious programs on the Internet
The second Top Twenty list below shows data generated by the web antivirus component and reflects the online threat landscape. This table includes malware detected on web pages and malware downloaded to victim machines from web pages.
|Position||Change in position||Name||Number of attempted downloads|
All of the malicious programs listed above have seen changes to their positions.
First place is occupied by Trojan-Clicker.JS.Iframe.bb, which infected almost 400,000 websites during May alone. This Trojan aims to increase website hit counts by making the victim computers visit them without the users’ knowledge or consent.
The new Trojan.JS.Redirector.cq (in 3rd place) redirects visitors to websites distributing rogue antivirus programs.
Seven malicious programs in the Top 20 are exploits. It is remarkable that three newcomers, namely Exploit.Java.CVE-2010-0886.a, Exploit.Java.Agent.f, and Exploit.Java.CVE-2009-3867.d are exploits for the Java platform.
The second newcomer, Exploit.Java.CVE-2009-3867.d is in 6th place. This exploit uses the stack overflow technique by calling the function getSoundBank. This function is used to download media content and expects to get the URL of a soundbank object as its parameter. This vulnerability enables the cybercriminals to use a shell code with which they can then run any code they want to on the victim computer.
The above exploits are typically associated with redirectors and legitimate, but infected, websites. The list of such ‘companion’ malware in May includes Trojan.JS.Agent.bhr (in 5th place), Trojan.JS.Zapchast.dv (in 10th place), Trojan.JS.Iframe.lq (in 12th place) and Trojan-Downloader.JS.Agent.fig (in 13th place).
Countries launching the most web-borne infections:
In recent months cybercriminals have actively used exploits in order to steal users’ confidential data. Changes have been affecting malware propagation techniques and methods that prevent the analysis and detection of malware.
Eleven of May’s Top 20 malicious programs from the Internet are different exploits and their related Trojans. These malicious programs occupy five consecutive Top 20 places starting from 2nd place and then appear on the list in groups of two or three variants.
It is also worth noting that users of Sun software are strongly advised to check for software updates on a regular basis. This advice is given as there is a lot of malware around exploiting the vulnerabilities in the Java platform.