Malware reports

Online Scanner Top Twenty for December 2006

Position Change in position Name Percentage
1. Up
Trojan.Win32.Dialer.cj 14.56
2. Up
Trojan.Win32.Dialer.hz 10.27
3. New!
Net-Worm.Win32.Mytob.c 7.92
4. New!
New! 6.80
5. Up
Email-Worm.Win32.Rays 5.27
6. New!
Email-Worm.Win32.Mydoom.m 3.66
7. New!
Trojan.Win32.Dialer.a 3.27
8. New!
New! 3.08
9. Down
Email-Worm.Win32.Brontok.q 3.03
10. Down
Trojan.Win32.Dialer.hh 2.51
11. New!
New! 2.35
12. Return
Return 2.22
13. New!
Trojan-Downloader.Win32.Small.dam 2.10
14. New!
Trojan-Downloader.Win32.Tiny.fb 2.08
15. New!
Trojan.Win32.Dialer.on 1.59
16. New!
Email-Worm.Win32.Warezov.fb 1.46
17. New!
Trojan.Win32.Dialer.qi 1.24
18. No Change Trojan-Downloader.Win32.INService.gen 1.22
19. Down
not-a-virus:PSWTool.Win32.RAS.a 1.20
20. New!
Email-Worm.Win32.Scano.bk 1.16
Other malicious programs 84.91


December reinforced the unexpected trend of Trojan dialers appearing in the online Top Twenty. In November four such programs made it to our rankings, in December their number grew to six. In November the most successful of these programs took the second and third positions; in December these were replaced with others, which rose to the first and second places. In November we explained the way such Trojans operate, so we will not discuss them at length here. We will only mention that a few days ago the news came that several developers of such malicious programs, which mostly circulated in 2003-2004, have been jailed in Germany. Apparently, this illegal method of making money remains quite popular among cybercriminals.

Surprisingly, the third position was taken by the Mytob.c worm. Until now, it has been a regular feature on our email Top Twenty, but this is the first time it has made it to the online charts. This will become less surprising, however if you notice that seven more worms are present in the online Top Twenty statistics. Many of these have also been detected and monitored in the email traffic for a long time, but December was a début of sorts for them in the online statistics. They include Mydoom.m, and Scabo.bk. The newcomers to December’s email Top Twenty, and Warezov.fb, are also present in the online charts. And, of course the Rays and Brontok worms just won’t give up.

The third most popular category in our online statistics, after dialers and worms are Trojan downloaders. In previous months representatives of this class, such as Delf.awg, took up leading positions. There are fewer of them in December’s rankings, but two Trojans from the Tiny family are present. This name is new to our statistics and we will be sure to follow the fate of these malicious programs in the coming year.

Online Scanner Top Twenty for December 2006

Your email address will not be published. Required fields are marked *



Operation TunnelSnake

A newly discovered rootkit that we dub ‘Moriya’ is used by an unknown actor to deploy passive backdoors on public facing servers, facilitating the creation of a covert C&C communication channel through which they can be silently controlled. The victims are located in Africa, South and South-East Asia.

APT trends report Q1 2021

This report highlights significant events related to advanced persistent threat (APT) activity observed in Q1 2021. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports.

The leap of a Cycldek-related threat actor

The investigation described in this article started with one such file which caught our attention due to the various improvements it brought to this well-known infection vector.

Subscribe to our weekly e-mails

The hottest research right in your inbox