Malware reports

Online Scanner Top Twenty for December 2006

Position Change in position Name Percentage
1. Up
Trojan.Win32.Dialer.cj 14.56
2. Up
Trojan.Win32.Dialer.hz 10.27
3. New!
Net-Worm.Win32.Mytob.c 7.92
4. New!
New! 6.80
5. Up
Email-Worm.Win32.Rays 5.27
6. New!
Email-Worm.Win32.Mydoom.m 3.66
7. New!
Trojan.Win32.Dialer.a 3.27
8. New!
New! 3.08
9. Down
Email-Worm.Win32.Brontok.q 3.03
10. Down
Trojan.Win32.Dialer.hh 2.51
11. New!
New! 2.35
12. Return
Return 2.22
13. New!
Trojan-Downloader.Win32.Small.dam 2.10
14. New!
Trojan-Downloader.Win32.Tiny.fb 2.08
15. New!
Trojan.Win32.Dialer.on 1.59
16. New!
Email-Worm.Win32.Warezov.fb 1.46
17. New!
Trojan.Win32.Dialer.qi 1.24
18. No Change Trojan-Downloader.Win32.INService.gen 1.22
19. Down
not-a-virus:PSWTool.Win32.RAS.a 1.20
20. New!
Email-Worm.Win32.Scano.bk 1.16
Other malicious programs 84.91


December reinforced the unexpected trend of Trojan dialers appearing in the online Top Twenty. In November four such programs made it to our rankings, in December their number grew to six. In November the most successful of these programs took the second and third positions; in December these were replaced with others, which rose to the first and second places. In November we explained the way such Trojans operate, so we will not discuss them at length here. We will only mention that a few days ago the news came that several developers of such malicious programs, which mostly circulated in 2003-2004, have been jailed in Germany. Apparently, this illegal method of making money remains quite popular among cybercriminals.

Surprisingly, the third position was taken by the Mytob.c worm. Until now, it has been a regular feature on our email Top Twenty, but this is the first time it has made it to the online charts. This will become less surprising, however if you notice that seven more worms are present in the online Top Twenty statistics. Many of these have also been detected and monitored in the email traffic for a long time, but December was a début of sorts for them in the online statistics. They include Mydoom.m, and Scabo.bk. The newcomers to December’s email Top Twenty, and Warezov.fb, are also present in the online charts. And, of course the Rays and Brontok worms just won’t give up.

The third most popular category in our online statistics, after dialers and worms are Trojan downloaders. In previous months representatives of this class, such as Delf.awg, took up leading positions. There are fewer of them in December’s rankings, but two Trojans from the Tiny family are present. This name is new to our statistics and we will be sure to follow the fate of these malicious programs in the coming year.

Online Scanner Top Twenty for December 2006

Your email address will not be published. Required fields are marked *



Focus on DroxiDat/SystemBC

An unknown actor targeted an electric utility in southern Africa with Cobalt Strike beacons and DroxiDat, a new variant of the SystemBC payload. We speculate that this incident was in the initial stages of a ransomware attack.

APT trends report Q2 2023

This is our latest summary of the significant events and findings, focusing on activities that we observed during Q2 2023.

Meet the GoldenJackal APT group. Don’t expect any howls

GoldenJackal is an APT group, active since 2019, that usually targets government and diplomatic entities in the Middle East and South Asia. The main feature of this group is a specific toolset of .NET malware, JackalControl, JackalWorm, JackalSteal, JackalPerInfo and JackalScreenWatcher.

Subscribe to our weekly e-mails

The hottest research right in your inbox