February has come and gone and another interesting month on the malware front it has been, and I have finally managed to find a bit of time to write a review!
Like previous months, I will cover some statistics from my own sensors and compare those against those from a couple of major anti-virus companies, and finally I will cover new and interesting things that occurred during the month.
I have created some graphs and performed some trend analysis from the raw data from my WormCharmer and Bayesian filter .
I have included four sources of information for the graphs and pie-charts, these are:
The last two are my own projects and all data is from the Internet, these systems are running on an aDSL link and are personal research projects that have been running for some time; WormCharmer 3 years, Malware Bayesian Filter 2 years.
In total I captured 1115 samples during February, which have been catalogued as 64 distinct families and variants. In comparison during January I captured 2645 samples which were catalogued as 86 distinct families/variants. As you can see the captures in February were below half of the January total. During February I captured and submitted 8 brand new malware strains/variants [unknown to all or most AV companies at the time of submission].
The low haul in February is mainly due to the apparent slow-down in new samples being spread via SMB [Windows shares] which was first noticed in December 2005.
During February I reported 110 new Phishing sites which are now included in the Netcraft phishing site database used by the Netcraft anti-phishing toolbar which I blogged about some time ago.
The first pie chart below shows the Top 10 distinct malware by percentage. Let us look at this in more detail:
W32/Tenga.3666 [Frisk] retained the pole position again during February. Not only that but is increased its share from 39 percent of all captured files during January to over 51 percent. This is a significant jump, however it is still not up to the 63 percent of all captured files it was responsible for in December 2005!
Although the Mytobs bounced back in January recovering significant ground lost during December 2005 they lost some more ground during February. MyWife which made a significant splash in Janaury disappeared from the top 10 during February.
It seems that the share-crawling worms recovered some ground they lost during January; in fact their share rose from two to five. Netsky.P managed to retain a top ten position, but Lovgate.X did not.
If you compare the above to the data from Kaspersky and also the data from SOPHOS you may see some marked differences. Why? Well, simply my sample capture systems collect data from multiple ‘vectors’ and combine the data, so I tend to get a more rounded picture of what is really running round the Internet in the way of net nasties.
As you can see the top 10 from Kaspersky [below] this month has seen Zafi.d lose its hold on the top spot, falling to third place. Its pole position has been stolen by Mytob.c and second place has been grabbed by Lovegate.w. The rest of the chart is made up of Netsky.t in fourth, another Netsky family member [b] takes fifth place followed by a Bagle variant [fj] in sixth spot. Mytob variants [u and q] in seventh and eighth place. Netsky.q breaks up the Mytob run by stealing ninth place. The final place is occupied by another Mytob variant [ t], just managing to keep a place in the top 10.
In the SOPHOS chart we see a different pattern, with Netsky.p has grabbed back the top position this month. Second place is filled by Nyxem.D[aka MyWife] with Bagle-Zip snapping at its heels in third. Zafi.b has been relegated to fourth place closely followed by two Mytob variants [ EX, FO] in fith and sixth place respectively. Another Bagle [CH] grabs seventh followed by a new malware family known as Clagger in eighth. The final two slots are occupied by Netsky.D and yet another Mytob [BE].
The final pie chart below shows the Top 10 malware families trapped by percentage. As you can see this includes not only mass-mailers but also share-crawling worms and bots. This month the table is headed up once more by the September 2005 leader Tenga, which has increased its share from 39 percent of all samples caught in January to over 51percent in February. Mytob managed to consolidate its hold on second place. Third place is occupied by Netsky once more which was stolen by MyWife [aka Nyxem] in January. Mydoom and Bagle complete the e-mail worms appearing in the top 10. The rest of the vacant spots are taken by share crawling worms and bots, these being: Opaserve, Sdbot, Ranky and the related multi-component dropper. The top ten is rounded off by Agobot making a re-entry in ninth.
If you wish to see the current top 10, then see my external website at http://arachnid.homeip.net. The data which feeds the WormCharmer stats is updated every 3 minutes 24 hours a day [barring power-cuts, internet connectivity issues or hardware faults].
Please feel free to ask questions if you need any clarification on the data, the setup or whatever.
Now, let’s switch to a different method: The following graph shows the percentage of malware that I received and my Bayesian Filtering tool classified correctly. You can see the data for the whole of 2004, 2005 and 2006 [up to the end of February] here. This clearly shows that February was significantly quieter than January; in fact it was only slightly busier than December 2005, which was the quietest month in the last two years!
The raw statistics (both CSV and Graphed) can be found in the usual place on my site. If you feel you need access then please contact me to discuss.
If we look at the overall growth of malware so far this year, it grew from 168,807 [as at the end of December 2005] to 181,608 [as at the end of February 2006]. That’s a growth of 12,801 in two months! In 2005 we saw 56,369 new malware strains compared to 28,327 in 2004, so we have seen an almost 200 percent increase in new malware strains during 2005. Using the first two months data to extrapolate possible numbers of new malware in 2006, we get a whopping 76,806. However, I suspect that the total at the end of 2006 will exceed 100,000.
What’s New?
Instead of including commentary here about things I have already written about, I will offer links to other blog entries that may be of interest or cover some of the interesting occurrences in February 2006.
Links:
.
Fahd
