May has come and gone and we are almost halfway through the year already. Another interesting month on the malware front it has been although as you will see the number of trapped malware is still low.
Like previous months, I will cover some statistics from my own sensors and compare those against those from a couple of major anti-virus companies, and finally I will cover new and interesting things that occurred during the month.
I have created some graphs and performed some trend analysis from the raw data from my WormCharmer and Bayesian filter .
I have included four sources of information for the graphs and pie-charts, these are:
The last two are my own projects and all data is from the Internet, these systems are running on an aDSL link and are personal research projects that have been running for some time; WormCharmer 3 years, Malware Bayesian Filter 2 years.
In total I captured 1115 samples during May, which have been catalogued as 51 distinct families and variants. In comparison during April I captured 1657 samples which were catalogued as 54 distinct families/variants. As you can see the captures in May are down on both April and March and still below the high of January’s total.
During May I captured and submitted 6 brand new malware strains/variants [unknown to all or most AV companies at the time of submission].
The low haul in May is mainly due to the apparent slow-down in new samples being spread via SMB [Windows shares] which was first noticed in December 2005. Part of the reason for this slow down is that the malware authors are using other methods to initially seed their offspring, such as Instant Messaging and e-mail using links instead of attachments, and where attachments are used these tend to be droppers or downloaders which are crafted to evade anti-virus tools.
During May I reported 153 new Phishing sites which are now included in the Netcraft phishing site database used by the Netcraft anti-phishing toolbar which I blogged about some time ago.
The first pie chart below shows the Top 10 distinct malware by percentage. Let us look at this in more detail:
W32/Tenga.3666 [Frisk] retained the pole position again during April. Its percentage fell from 73 percent [in March] to 53 percent [in April] to 51 percent of the pie.
Netsky.P lost its second place slot from March falling down the chart to seventh place but regained some ground in May grabbing back fifth place.
The Mytobs lost the ground they regained during April when they accounted for five slots in the top ten. In May they captured just two out of ten places, the same as they had in March.
The share-crawling worms regained their hold they had on March’s table where they took six out of ten places. In April they they were down to just three places, halving their presence. In May they are back, grabbing six of the ten places.
The only other mass-mailing worm that made it into the top ten was W32/Kapser.A@mm [FRISK] aka W32/MyWife.D@MM [McAfee] grabbing fourth spot after falling out of the top ten in April.
If you compare the above to the data from Kaspersky and also the data from SOPHOS you may see some marked differences. Why? Well, simply my sample capture systems collect data from multiple ‘vectors’ and combine the data, so I tend to get a more rounded picture of what is really running round the Internet in the way of net nasties.
As you can see the top 10 from Kaspersky [below] this month has seen the the Mytob family grab five places out of the top ten.
In pole position we have Mytob.c, which was also number one for the last three months. Lovegate.w moves from third place in April to second in May, stealing the spot from Netsky.t which held it for the last two months. Netsky.q likewise climbs one spot from takes fourth place to third in May. Lovegate.ad which was a new entry at number five in April has also climbed one place to fourth. The rest of the chart is made up of Mytob variants [u, t, a and q] in seventh, eighth, ninth and tenth place respectively.
In the SOPHOS chart we see a different pattern; Netksy.p has consolidated its number one slot which it lost in March and grabbed back in April. Zafi.b consolidates its grip second place. Nyxem.D[aka MyWife] has further consolidated its third place from March. Mytob.AS storms up the chart from tenth to fourth. Mytob variants P and M are new entries this month, in fifth and sixth place respectively. Another Netsky [D] falls from fifth place to seventh. Mydoom.O sneaks in to grab eighth place. The final places are made up of Mytob variants [ FO and C] in ninth and tenth respectively.
The final pie chart below shows the Top 10 malware families trapped by percentage. As you can see this includes not only mass-mailers but also share-crawling worms and bots. This month the table is headed up once more by the September 2005 leader Tenga, which has dropped from 73 percent of all samples caught in March to just 51 percent in May. Mytob has consolidated its second place, closely followed by Operserv in third, again. Netsky climbs two places from sixth to fourth. W32.Kapser [aka MyWife.D climbs back up to fifth place in May. Mydoom, slips from fifth in March to eighth in May’s chart. Dupator climbs back in to the chart in sixth spot. A new entry at seven is the Zapchast Trojan. More new entries capture the last two spots; Tirbot in ninth and Lebreat in tenth.
If you wish to see the current top 10, then see my external website at http://arachnid.homeip.net. The data which feeds the WormCharmer stats is updated every 3 minutes 24 hours a day [barring power-cuts, internet connectivity issues or hardware faults].
Please feel free to ask questions if you need any clarification on the data, the setup or whatever.
Now, let’s switch to a different method: The following graph shows the percentage of malware that I received and my Bayesian Filtering tool classified correctly. You can see the data for the whole of 2004, 2005 and 2006 [up to the end of May] here. This clearly shows that May was quieter than April, which was the quietest month ever in the case of e-mail borne malware being trapped.
An interesting quote from SOPHOS highlights the drop-off in malware being spread or seeded via e-mail:
“The proportion of email which is virus infected has dropped considerably over the last year as hackers have turned from mass-mailing attacks to targeted Trojan horses. In May 2005, one in every 38 emails was infected, now [in May 2006] this number is just one in 141.”
The raw statistics (both CSV and Graphed) can be found in the usual place on my site. If you feel you need access then please contact me to discuss.
If we look at the overall growth of malware so far this year, it grew from 168,807 [as at the end of December 2005] to 194,799 [as at the end of May 2006]. That’s a growth of 25,992 new malware strains and/or variants in the first five months of the year.
What’s New?
Instead of including commentary here about things I have already written about, I will offer links to other blog entries that may be of interest or cover some of the interesting occurrences in May 2006.
Conclusions:
Malware growth picked up once more during May and apart from spam growing, both phishing and 419 scams have shown a slight drop since April. The growth in malware, including spyware which uses rootkit [cloaking/stealth] techniques is becoming a major problem and corporations need to address this now before it gets completely out of control with widespread infestations throughout their infrastructure. This trend for hiding or obfuscating code is not only limited to using ‘rootkit-like’ stealthing techniques but also include the current move by many malware authors towards making their code polymorphic.
Another interesting quote from SOPHOS clearly shows the change in the threat landscape in respect to malware:
“Sophos identified 1,538 new threats in May, bringing the total of malware protected against to 122,634. The majority of the new threats (85.1%) were Trojan horses, while just 12.3% were worms or viruses.”
Kaspesrsky have gone one step further and claim: “global email worm epidemics are already a thing of the past.”
I suspect that they are generally correct, but I believe that we will see the occasional one ‘get lucky’ as firms start to lower their defences in response to this apparent trend in mass-mailing worms.
Links:
