April has come and gone and spring has arrived. Another interesting month on the malware front it has been although as you will see the number of trapped malware is still low.
Like previous months, I will cover some statistics from my own sensors and compare those against those from a couple of major anti-virus companies, and finally I will cover new and interesting things that occurred during the month.
I have created some graphs and performed some trend analysis from the raw data from my WormCharmer and Bayesian filter .
I have included four sources of information for the graphs and pie-charts, these are:
The last two are my own projects and all data is from the Internet, these systems are running on an aDSL link and are personal research projects that have been running for some time; WormCharmer 3 years, Malware Bayesian Filter 2 years.
In total I captured 1657 samples during April, which have been catalogued as 54 distinct families and variants. In comparison during March I captured 1356 samples which were catalogued as 61 distinct families/variants. As you can see the captures in April are only slightly up on March and still below the high of January’s total.
During April I captured and submitted 5 brand new malware strains/variants [unknown to all or most AV companies at the time of submission].
The low haul in April is mainly due to the apparent slow-down in new samples being spread via SMB [Windows shares] which was first noticed in December 2005. Part of the reason for this slow down is that the malware authors are using other methods to initially seed their offspring, such as Instant Messaging and e-mail using links instead of attachments, and where attachments are used these tend to be droppers or downloaders which are crafted to evade anti-virus tools.
During April I reported 157 new Phishing sites which are now included in the Netcraft phishing site database used by the Netcraft anti-phishing toolbar which I blogged about some time ago.
The first pie chart below shows the Top 10 distinct malware by percentage. Let us look at this in more detail:
W32/Tenga.3666 [Frisk] retained the pole position again during April. Its percentage fell from 73 percent [in March] to 53 percent of the pie.
Netsky.P lost its second place slot from March falling down the chart to seventh place.
The Mytobs regained the ground lost during March when they accounted for just two slots in the top ten. In April they captured five out of ten places.
The share-crawling worms lost their hold they had on March’s table where they took six out of ten places. In April they are down to just three places, halving their presence.
The only other mass-mailing worm that made it into the top ten was W32/Mydoom.o@MM [McAfee].
If you compare the above to the data from Kaspersky and also the data from SOPHOS you may see some marked differences. Why? Well, simply my sample capture systems collect data from multiple ‘vectors’ and combine the data, so I tend to get a more rounded picture of what is really running round the Internet in the way of net nasties.
As you can see the top 10 from Kaspersky [below] this month has seen the Zafi family move out of the top ten.
In pole position we have Mytob.c, which was also number one for the last two months. Second place is occupied by Netsky.t [same as in March]. Lovegate.w makes a return [in third]. Netsky.q takes fourth place [up from seventh]. Lovegate.ad is a new entry at number five. The rest of the chart is made up of Netsky .b in sixth place [down from fourth. Mytob variants [y, t, u and q] in seventh, eighth, ninth and tenth place respectively.
In the SOPHOS chart we see a different pattern; Netksy.p has grabbed back its number one slot which it lost in March. Zafi.b slips from pole to second. Nyxem.D[aka MyWife] has consolidated its third place from March. Mydoom-AJ is stationary in fourth place [it was a new entry in March]. Another Netsky [D] grabs fifth place. The final places are made up of Mytob variants [ FO, C, Z and AS] in sixth, seventh, eighth and tenth respectively, broken up by the presence of a new entry Delebot.A in ninth.
The final pie chart below shows the Top 10 malware families trapped by percentage. As you can see this includes not only mass-mailers but also share-crawling worms and bots. This month the table is headed up once more by the September 2005 leader Tenga, which has dropped from 73 percent of all samples caught in March to just 53 percent in April. Mytob has grabbed back second place from Operserv which slips down to third. Fourth place is occupied by Mydoom, up from fifth in March. Netsky slips one place to sixth. Mytob.The rest of the vacant spots are almost all taken by share crawling worms and bots, these being: Sdbot, Ranky and the related multi-component dropper. The only e-mail based worms which appear in the lower five places of the chart are W32.Reatle and W32.Kapser [aka MyWife.D.
If you wish to see the current top 10, then see my external website at http://arachnid.homeip.net. The data which feeds the WormCharmer stats is updated every 3 minutes 24 hours a day [barring power-cuts, internet connectivity issues or hardware faults].
Please feel free to ask questions if you need any clarification on the data, the setup or whatever.
Now, let’s switch to a different method: The following graph shows the percentage of malware that I received and my Bayesian Filtering tool classified correctly. You can see the data for the whole of 2004, 2005 and 2006 [up to the end of April] here. This clearly shows that April was quieter than December 2005, which was the quietest month ever in the case of e-mail borne malware being trapped.
The raw statistics (both CSV and Graphed) can be found in the usual place on my site. If you feel you need access then please contact me to discuss.
If we look at the overall growth of malware so far this year, it grew from 168,807 [as at the end of December 2005] to 188,252 [as at the end of April 2006]. That’s a growth of 19,445. Interestingly just like in March the growth of new malware slowed in April by almost 50 percent when compared to the first two months of the year
What’s New?
Instead of including commentary here about things I have already written about, I will offer links to other blog entries that may be of interest or cover some of the interesting occurrences in April 2006.
Conclusions:
Although malware growth slowed during April, you may have noticed that spam, phishing and 419 scams have been very aggressive during the same period and they show no sign of stopping. The growth in malware, including spyware which uses rootkit [cloaking/stealth] techniques is becoming a major problem and corporations need to address this now before it gets completely out of control with widespread infestations throughout their infrastructure.
On this subject, I have been asked to present on ‘Rootkits’ at the Virus Bulletin 2006 conference to be held later this year. The paper will be made available for all to read once it has been presented.
Links:
