Well, July has come and gone, and another interesting [and very, very, busy] month it has been on the malware front! I can’t believe that seven months of the year have already gone and we’ve seen so much malware, almost as much as the whole of last year, by the end of July!
Like previous months, I will cover some statistics from my own sensors and compare those against some from a couple of major anti-virus companies, and finally I will cover new and interesting things that occurred during July.
I have created some graphs and performed some trend analysis from the raw data from my WormCharmer and Bayesian filter for July. Hope they are of some interest?
I have included four [I have added data from SOPHOS to the pot] sources of information for the graphs and pie-charts, these are:
The last two are my own projects and all data is from the Internet, these systems are running on an aDSL link and are personal research projects that have been running for some time; WormCharmer 2.5 years, Malware Bayesian Filter 1.5 years.
In total I captured 5868 samples during July, which have been catalogued as 98 distinct families and variants. In comparison during June 2005 I captured 5742 samples which were catalogued as 142 distinct families/variants. As you can see this is a small percent increase in samples captured but still around double my more usual numbers per month!
During July I captured and submitted 11 brand new malware strains/variants [unknown to all or most AV companies at the time of submission]. However, these were just the ones I managed to capture and process before my ISP decided to block ports 137/udp, 139/tcp and 445/udp and tcp which are used by most of the share-crawling worms and bots. I’m now in the process of moving ISP. Unfortunately this will affect my August statistics too.
During July I started to report Phishing sites and actually reported 40 during the month which are now included in the Netcraft phishing site database used by the Netcraft anti-phishing toolbar which I blogged about some time ago.
The first pie chart below shows the Top 10 distinct malware by percentage. Let us look at this in more detail:
The e-mail worm, bot and share-crawling worm W32/Mytob.ce@MM [McAfee] was the sample with the highest number of captures [22% of all captured files] followed by seven others of the same malware family. Only two other malware families appears in the Top 10 in July; Mydoom [W32.Mydoom.o@MM and W32.Mydoom.bb@MM] and one TENGA variant [PE_TENGA.A] which is a new malware family. So, it seems that the Mytob World domination plan is working out all too well at the moment. If I go as far as looking at the Top 20; 9 of the places are occupied by a Mytob variant. If I extend this even further in the Top 100 there are 13 variants of Mytob.
If you compare the above to the data from Kaspersky and also the data from SOPHOS you may see some marked differences. Why? Well, simply my sample capture systems collect data from multiple ‘vectors’ and combine the data, so I tend to get a more rounded picture of what is really running round the Internet in the way of net nasties.
As you can see the top 10 from Kaspersky is dominated by Netsky.q and Mytob.c, followed by 2 Zafi variants [b and d], yet more Mytobs and finally Netsky.b.
In the SOPHOS chart we see a similar pattern, with Netsky.p as the leader of the pack with 3 Mytob variants [AS, BE and EP] hot on it’s heels. However in the SOPHOS data only one Zafi variant appears [D]. The rest of the chart is taken up by yet more Mytob variants and Netsky.D.
The final pie chart below shows the Top 10 malware families trapped by percentage. As you can see this includes not only mass-mailers but also share-crawling worms and bots. As you may notice, the Mytob family account for 76 percent of all samples captured during July which is amazing for a malware family that didn’t exist until almost the end of February this year.
If you wish to see the current top 10, then see my external website at http://arachnid.homeip.net. The data which feeds the WormCharmer stats is updated every 3 minutes 24 hours a day [barring power-cuts, internet connectivity issues or hardware faults].
Please feel free to ask questions if you need any clarification on the data, the setup or whatever.
Now, let’s switch to a different method: The following graph shows the percentage of malware that I received and my Bayesian Filtering tool classified correctly. You can see the data for the whole of 2004 and 2005 [up to the end of July] here. This clearly shows that July was slightly busier than June, in fact as you can see the last time it was this busy was back in April and May 2004 [as far as e-mail based malware was concerned] which was when the Bagle, Netsky and Mydoom wars were raging.
The raw statistics (both CSV and Graphed) can be found in the usual place on my site. If you feel you need access then please contact me to discuss.
If we look at the overall growth of malware so far this year, it grew from 112,438 [as at the end of December 2004] to 139,515 [as at the end of July 2005]. That’s a growth of 27,077 so far this year, and we are only seven months through the year! Last year in total we saw 28,327 new malware strains. Looks like we could see 45,000 new malware strains by the end of the year, sheesh!
In July we saw the following new malware appear:
A number of new Mytob variants. This is family of worms which first appeared in March’s results is based on the MyDoom e-mail worm, but with a twist! The source code was modified to also enable it to spread using the LSASS exploit [ala Sasser], as well as via the more common e-mail vector that MyDoom used. Some Mytob variants also spread in other ways, such as via Instant Messaging and Peer to Peer networks.
The malware authoring group behind Mytob call themselves HELLBOT. They are continuing to experiment with packers and compressors [PEX, UPX, etc.] to try and make their new variants more difficult to detect by many of the AV products. They have also been changing and adding to the bots functionality. Finally, they have modified the list of IRC channels used as command and control for the bot and the resulting botnets. This is being done because channels used by previous variants have been quickly closed by IRC server administrators as they start to fight back.
It seems that July was a busy month for malware authors who are interested in stealing data with many bots being created and released onto the Internet. Expect more of this as the move to a “for-profit” model continues to take over in the malware world.
Conclusions:
Well, as you can see the Mytobs are dominating the statistics and are causing increasing levels of pain; not just to those that are infected, but also to the AV companies. They seem to be unwilling to let any other malware in to the Top 10.
Would anyone be interested if I also included my own hoax, Phishing and SPAM statistics to this monthly report?
UPDATE: Looks like August is going to be busy too! My sample captures already this month [10th August] are slightly higher than usual [even allowing for the lack of certain malware samples being caught due to my ISP blocking ports], if it carries on like this then we could be looking at over 4,000 by the end of the month….
Links:
Virus Top Twenty for July 2005 [Kaspersky]
Top ten viruses and hoaxes for July 2005 [Sophos]
