March has come and gone taking the first quarter of the year with it. Another interesting month on the malware front it has been although as you will see the number of trapped malware is still low.
Like previous months, I will cover some statistics from my own sensors and compare those against those from a couple of major anti-virus companies, and finally I will cover new and interesting things that occurred during the month.
I have created some graphs and performed some trend analysis from the raw data from my WormCharmer and Bayesian filter .
I have included four sources of information for the graphs and pie-charts, these are:
The last two are my own projects and all data is from the Internet, these systems are running on an aDSL link and are personal research projects that have been running for some time; WormCharmer 3 years, Malware Bayesian Filter 2 years.
In total I captured 1356 samples during March, which have been catalogued as 61 distinct families and variants. In comparison during February I captured 1115 samples which were catalogued as 64 distinct families/variants. As you can see the captures in March are only slightly up on February and still below the high of January’s total.
During March I captured and submitted 10 brand new malware strains/variants [unknown to all or most AV companies at the time of submission]. Details on these new malware can be found on my VSUB blog.
The low haul in March is mainly due to the apparent slow-down in new samples being spread via SMB [Windows shares] which was first noticed in December 2005, although there has been a slight increase noticed during March.
Furthermore I reported 135 new Phishing sites which are now included in the Netcraft phishing site database used by the Netcraft anti-phishing toolbar which I blogged about some time ago.
The first pie chart below shows the Top 10 distinct malware by percentage. Let us look at this in more detail:
W32/Tenga.3666 [Frisk] retained the pole position again during March. Not only that but is increased its share from 51 percent of all captured files during February to over 73 percent. This is a significant jump, and eclipses its own record of 63 percent it achieved in December 2005!
Netsky.P managed to grab the second place slot during March, however it only managed 3 percent of the total captures.
The Mytobs lost more ground during March barely managing to capture just 2 of the top 10 places; sixth and seventh.
It seems that the share-crawling worms consolidated their hold on the ground they won back in February taking six out of ten places.
The only other mass-mailing worm that made it into the top ten was W32/Mydoom.bb@MM [McAfee].
If you compare the above to the data from Kaspersky and also the data from SOPHOS you may see some marked differences. Why? Well, simply my sample capture systems collect data from multiple ‘vectors’ and combine the data, so I tend to get a more rounded picture of what is really running round the Internet in the way of net nasties.
As you can see the top 10 from Kaspersky [below] this month has seen Zafi.d move out of the top ten, however Zafi.b has managed to retain a spot in the top 10, in this case it is 6th.
In pole position we have Mytob.c, which was also number one last month. Second place has been grabbed from Lovegate.w [down to third] by Netsky.t [up from fourth]. The rest of the chart is made up of Netsky .b takes fourth place [up from fifth] followed by Mytob.u in fifth, Netsky.q breaks up the Mytob run by stealing seventh place. Mytob variants [q and t] in eighth and ninth place. The final place is occupied by Lovegate.ae just managing to keep a place in the top 10.
In the SOPHOS chart we see a different pattern, with Zafi.b back in pole [up from fourth], Netsky.p has slipped a place from pole to second. Likewise Nyxem.D[aka MyWife] has slipped one place down from second to third with Mydoom-AJ stealing fourth place [new entry]. Mytob-EX takes the highest spot for its family, in fifth, followed by last months new entry Clagger-I in sixth. The final places are made up of three Mytob variants [BE, FO and Z] in seventh, ninth and tenth respectively, broken up by the presence of another Netsky family member, in this case D in eighth.
Did you notice the lack of Bagles seen in March?
The final pie chart below shows the Top 10 malware families trapped by percentage. As you can see this includes not only mass-mailers but also share-crawling worms and bots. This month the table is headed up once more by the September 2005 leader Tenga, which has increased its share from 51 percent of all samples caught in February to over 73 percent in March. Mytob lost the second spot it held in February to Operserv, slipping down to fourth. Third place is occupied by Netsky once more consolidating its position here. Mytob has slipped to fourth with Mydoom in fifth. The rest of the vacant spots are almost all taken by share crawling worms and bots, these being: Sdbot, Ranky and the related multi-component dropper and Dupator. The only e-mail based worm that appears in the lower five places in the chart is WORM_REATLE which is a new entry, in at ninth.
If you wish to see the current top 10, then see my external website at http://arachnid.homeip.net. The data which feeds the WormCharmer stats is updated every 3 minutes 24 hours a day [barring power-cuts, internet connectivity issues or hardware faults].
Please feel free to ask questions if you need any clarification on the data, the setup or whatever.
Now, let’s switch to a different method: The following graph shows the percentage of malware that I received and my Bayesian Filtering tool classified correctly. You can see the data for the whole of 2004, 2005 and 2006 [up to the end of March] here. This clearly shows that March was significantly quieter than January; however it was slightly busier than February.
The raw statistics (both CSV and Graphed) can be found in the usual place on my site. If you feel you need access then please contact me to discuss.
If we look at the overall growth of malware so far this year, it grew from 168,807 [as at the end of December 2005] to 185,252 [as at the end of March 2006]. That’s a growth of 16,445 in the first quarter of the year! Using the first quarters data to extrapolate possible numbers of new malware in 2006, we get a whopping 65,780. However, I suspect that the total at the end of 2006 will exceed 100,000 as the growth of new malware slowed in March by almost 50 percent.
What’s New?
Instead of including commentary here about things I have already written about, I will offer links to other blog entries that may be of interest or cover some of the interesting occurrences in March 2006.
Conclusions:
Although malware growth slowed during March, you may have noticed phishing and 419 scams have been very aggressive during March and they show no sign of stopping. The growth in malware that uses rootkit [cloaking/stealth] techniques is becoming a major problem and corporations need to address this now before it gets completely out of control with widespread infestations throughout their infrastructure.
On this subject, I have been asked to present on ‘Rootkits’ at the Virus Bulletin 2006 conference to be held later this year. The paper will be made available for all to read once it has been presented.
Links:
