Malware reports

Online Scanner Top Twenty for December 2006

Position Change in position Name Percentage
1. Up
Trojan.Win32.Dialer.cj 14.56
2. Up
Trojan.Win32.Dialer.hz 10.27
3. New!
Net-Worm.Win32.Mytob.c 7.92
4. New!
New! 6.80
5. Up
Email-Worm.Win32.Rays 5.27
6. New!
Email-Worm.Win32.Mydoom.m 3.66
7. New!
Trojan.Win32.Dialer.a 3.27
8. New!
New! 3.08
9. Down
Email-Worm.Win32.Brontok.q 3.03
10. Down
Trojan.Win32.Dialer.hh 2.51
11. New!
New! 2.35
12. Return
Return 2.22
13. New!
Trojan-Downloader.Win32.Small.dam 2.10
14. New!
Trojan-Downloader.Win32.Tiny.fb 2.08
15. New!
Trojan.Win32.Dialer.on 1.59
16. New!
Email-Worm.Win32.Warezov.fb 1.46
17. New!
Trojan.Win32.Dialer.qi 1.24
18. No Change Trojan-Downloader.Win32.INService.gen 1.22
19. Down
not-a-virus:PSWTool.Win32.RAS.a 1.20
20. New!
Email-Worm.Win32.Scano.bk 1.16
Other malicious programs 84.91


December reinforced the unexpected trend of Trojan dialers appearing in the online Top Twenty. In November four such programs made it to our rankings, in December their number grew to six. In November the most successful of these programs took the second and third positions; in December these were replaced with others, which rose to the first and second places. In November we explained the way such Trojans operate, so we will not discuss them at length here. We will only mention that a few days ago the news came that several developers of such malicious programs, which mostly circulated in 2003-2004, have been jailed in Germany. Apparently, this illegal method of making money remains quite popular among cybercriminals.

Surprisingly, the third position was taken by the Mytob.c worm. Until now, it has been a regular feature on our email Top Twenty, but this is the first time it has made it to the online charts. This will become less surprising, however if you notice that seven more worms are present in the online Top Twenty statistics. Many of these have also been detected and monitored in the email traffic for a long time, but December was a début of sorts for them in the online statistics. They include Mydoom.m, and Scabo.bk. The newcomers to December’s email Top Twenty, and Warezov.fb, are also present in the online charts. And, of course the Rays and Brontok worms just won’t give up.

The third most popular category in our online statistics, after dialers and worms are Trojan downloaders. In previous months representatives of this class, such as Delf.awg, took up leading positions. There are fewer of them in December’s rankings, but two Trojans from the Tiny family are present. This name is new to our statistics and we will be sure to follow the fate of these malicious programs in the coming year.

Online Scanner Top Twenty for December 2006

Your email address will not be published. Required fields are marked *



APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Subscribe to our weekly e-mails

The hottest research right in your inbox