MoMusings

October has come and it has been another very busy month for me. On the malware front it has been an interesting month with new techniques being used.

Like previous months, I will cover some statistics from my own sensors and compare those against those from a couple of major anti-virus companies, and finally I will cover new and interesting things that occurred during the month.

I have created some graphs and performed some trend analysis from the raw data from my WormCharmer and Bayesian filter.

I have included four sources of information for the graphs and pie-charts, these are:

• Kaspersky
• SOPHOS
• WormCharmer
• Malware Bayesian Filter

The last two are my own projects and all data is from the Internet, these systems are running on an aDSL link and are personal research projects that have been running for some time; WormCharmer 4 years, Malware Bayesian Filter 3 years.

In total I captured 886 samples during October, which have been catalogued as 54 distinct families and variants. In comparison during September I captured 1226 samples which were catalogued as 43 distinct families/variants. As you can see the captures in October are down from those of September.

During October I captured and submitted 3 brand new malware strains/variants [unknown to all or most AV companies at the time of submission].

The main reason for this general downward trend is that the malware authors are using other methods to initially seed their offspring, such as Instant Messaging and e-mail using links instead of attachments, and where attachments are used these tend to be droppers or downloaders which are crafted to evade anti-virus tools. This trend which started as a trickle at the start of the year is now a torrent. This means that real e-mail worms which use attachments are fast becoming an endangered species of malware.

During October I reported 140 new Phishing sites which are now included in the Netcraft phishing site database used by the Netcraft anti-phishing toolbar which I blogged about some time ago.

The first pie chart below shows the Top 10 distinct malware by percentage. Let us look at this in more detail:

W32/Tenga.3666 [Frisk] yet again retained the pole position during October. However, its percentage dropped, yet again, down from 57 percent in September to only 40.5 percent in October. Even allowing for this drop it seems very intent in keeping pole position for itself.

The Mytobs are definitely back. In August they completely dropped out of the chart, but one member of the family managed to storm back into the chart in September, grabbing second place. In October, Mytob.AC managed to keep hold of second spot, despite a number of challengers.

This reappearance of Mytob knocked Netsky.P from the second place it gained in August, back to third in September, and like Mytob.AC, is has consolidated its hold on this spot. Another member of the Netsky family [Netsky.AB] came into Octobers chart in fifth place.

The share-crawling worms which suffered a decrease in their numbers from seven of the ten slots in August to just four in September have managed to halt this decline. They still account for four of the ten places in October. The four are: Tenga.3666 in pole, Opaserv.worm.d in sixth, Opaserv.worm.ae in eighth and Dupator.1503 in ninth.

Mydoom reappeared in the chart during July with W32/Mydoom.o@MM jumping in to fifth spot. During October it regained one more spot from September, up from eighth to seventh.

The two new entries from September, known as IRC.Flood.b and ev [McAfee] have fallen back out of the top ten during October. They have been replaced by Warzov.gen3!W32DL and Bagle.fc!pwdzip in fourth and tenth places respectively.

If you compare the above to the data from Kaspersky and also the data from SOPHOS you may see some marked differences. Why? Well, simply my sample capture systems collect data from multiple ‘vectors’ and combine the data, so I tend to get a more rounded picture of what is really running round the Internet in the way of net nasties.

As you can see the top 10 from Kaspersky [below] October has seen the Mytob family completely disappear from the top ten. In September held four places out of the top ten.

Lovegate.w also falls out of the top ten in October along with Nyxem.E which was a new entry in Junes chart and has been in the top ten until now. Only one Netsky family member has survived the top ten shake-up that occurred in October, this being Netsky.q, which grabs pole.

Only one of the two new entries from September, both from the Scano family, have managed to stay in the top ten in October, this being Scano.gen, in fourth,with the aq variant replaced by another family member, this being the e variant, in tenth. Both of these variant arrive attached to a spammed e-mail message, the attachment is the virus. Scano does not spread on its own.

New entries this month include, three members of the Warezov family, these being, Warezov.dn in third spot, Warezov.ev in fifth, and Warezov.dc in seventh.

The rest of the chart is made up of Bagles; Bagle.gen in third and Bagle.mail in sixth, and Mydooms, Mydoom.l in eighth and Mydoom.m in ninth.

In the SOPHOS chart we see a different pattern; Netksy.p has further consolidated its number one slot which it lost in March and grabbed back in April. Zafi.b consolidated its place in eighth. Nyxem.D [aka MyWife] has slid down the chart from fourth to ninth. Mytob.AS has further consolidated its second place in the top ten, it stormed up the chart from fourth spot in June and we see two other Mytob family members in the top 10; this being C in sixth and E in tenth place. Another Netsky [D] consolidates its hold on fifth place. All members of the Mydoom family have fallen out of the top ten this month.

As with both my own top ten, and the top ten from Kaspersky, we have a couple of new entries, these being Stratio-Zip and Stratio-AY. Stratio is SOPHOS’s name for the warezov family, which is at least partially responsible for the recent jump in the amount of spam, but more on that next month.
To complete this month’s top ten we have W32.Bagle-Zip which was a new entry in June’s chart which slides down the chart from the third place which it grabbed in July, to fourth.

The final pie chart below shows the Top 10 malware families trapped by percentage. As you can see this includes not only mass-mailers but also share-crawling worms and bots. This month the table is headed up once more by the September 2005 leader Tenga, which has finally dropped from 57 percent in September 2006 to just 40.5 percent in October. Mytob is up one place to second after disappearing altogether from the chart in August and coming back in September in third. Operserv has slipped down one place from second to third place. Netsky has consolidated its hold on fourth. Mydoom drops out of the top ten. Dupator is up one space from eighth to seventh spot. Warezov is static in fifth place.

New entries include Downloader, Zapchat and Agent, in at eighth, ninth and tenth places respectively.

If you wish to see the current top 10, then see my external website at http://arachnid.homeip.net. The data which feeds the WormCharmer stats is updated every 3 minutes 24 hours a day [barring power-cuts, internet connectivity issues or hardware faults].

Please feel free to ask questions if you need any clarification on the data, the setup or whatever.

Now, let’s switch to a different method: The following graph shows the percentage of malware that I received and my Bayesian Filtering tool classified correctly. You can see the data for the whole of 2004, 2005 and 2006 [up to the end of October] here. This clearly shows that October was significantly down from September’s relative high. The overall trend is still downwards.

The raw statistics (both CSV and Graphed) can be found in the usual place on my site. If you feel you need access then please contact me to discuss.

If we look at the overall growth of malware so far this year, it grew from 168,807 [as at the end of December 2005] to 217,151 [as at the end of October 2006]. That’s a growth of 52,362 new malware strains and/or variants so far this year. We could see over 60,000 by the end of the year.

What’s New?
Instead of including commentary here about things I have already written about, I will offer links to other blog entries that may be of interest, topical, or cover some of the interesting occurrences in October 2006.

• An Orange Phish, not a Gold One
• Italian ex-Prime Minister Needs Your Help
• Do People Ever Learn From History?

Conclusions:
Malware, 419s and phishing scams have shown a significant drop in numbers during October, however this may not be all it seems as the amount of spam has grown almost fourfold in the same period.

Spammers are still increasing their use of graphical based spam, which is harder for anti-spam tools to identify without the use of OCR or other technologies; not only are they moving to graphical spam but to stop simple filtering based on hashing or check-summing of images, they are producing graphics that contain random micro-dots; this ensures that this type of filtering would be side-stepped. We have also seen animated GIF files being used by spammers, including some that use so-called subliminal programming techniques. We also saw spam being sent in Word documents. The latest trick is to use PNG files, instead of GIFs and also to use a graphic for each letter of the alphabet, sort of like a digital version of a ransom note cut from newspapers, but more on that next month.

Links:

• Virus Top Twenty for October 2006 [Kaspersky]
• Top ten viruses and hoaxes for October 2006 [Sophos]