English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Monthly Malware Statistics: May 2010

Malicious programs detected on users’ computers

The first Top Twenty list immediately below shows malware, adware and potentially unwanted programs that were detected and neutralized by the on-access scanner when they were accessed for the first time.

Position Change in position Name Number of infected computers
1   0 Net-Worm.Win32.Kido.ir   339585  
2   0 Virus.Win32.Sality.aa   210257  
3   0 Net-Worm.Win32.Kido.ih   201746  
4   0 Net-Worm.Win32.Kido.iq   169017  
5   9 Trojan.JS.Agent.bhr   161414  
6   -1 Worm.Win32.FlyStudio.cu   127835  
7   -1 Virus.Win32.Virut.ce   70189  
8   0 Trojan-Downloader.Win32.VB.eql   66486  
9   0 Worm.Win32.Mabezat.b   54866  
10   0 Trojan-Dropper.Win32.Flystud.yo   50490  
11   0 Worm.Win32.AutoIt.tc   47044  
12   1 Packed.Win32.Krap.l   44056  
13   New Trojan.JS.Iframe.lq   38658  
14   New Trojan.Win32.Agent2.cqzi   35423  
15   1 Trojan.Win32.Autoit.ci   34670  
16   New Trojan-GameThief.Win32.Magania.dbtv   31066  
17   New Trojan-Downloader.Win32.Geral.cnh   30225  
18   New Trojan.JS.Zapchast.dv   29592  
19   -2 Virus.Win32.Induc.a   28522  
20   -8 Exploit.JS.CVE-2010-0806.e   27606  

During May there were five new entries to the list.

Variants of the CVE-2010-0806 exploit left the Top 20 list as swiftly as they had joined it a month ago. However, malware writers are nowhere near through with exploiting the CVE-2010-0806 vulnerability. In May, Trojan.JS.Agent.bhr, a component of one of the CVE-2010-0806 exploit versions, moved up nine places to take up 5th position. The newcomer, Trojan.JS.Iframe.lq (13th place) is nothing but an intermediate link of a drive-by attack: it is used to redirect the user to Exploit.JS.CVE-2010-0806.i. Another piece of malware with a direct relationship to the CVE-2010-0806 vulnerability is Trojan.JS.Zapchast.dv. This Trojan is part of Exploit.JS.CVE-2010-0806.e which is currently in 20th place.

Trojan-GameThief.Win32.Magania.dbtv in 16th place lends support to the assumption that we made around a month ago concerning the purpose of the above exploits. Malware writers mainly use them to steal online gaming identities. This particular credential thief has impacted players of CabalOnline, Metin2, Mu Online and various games developed by Nexon.net.

The general scheme of infection is as follows:

  1. The user first visits a website contaminated by Trojan.JS.Iframe.lq, Trojan.JS.Zapchast.dv or either of the two versions of the CVE-2010-0806 exploit.
  2. The exploit then downloads Trojan-Downloader.Win32.Geral.cnh. This is a Trojan downloader that packs a pretty massive payload. Its malicious arsenal includes: two rootkits to help it hide from any security software; the Worm.Win32.Autorun component to ensure that the Trojan can propagate via detachable memory devices, and a download algorithm to allow the cybercriminals to use to-download lists.
  3. The Geral component downloads various versions of Trojan-PSW.Win32.QQPass, Trojan-GameTheif.Win32.OnlineGames/WOW/Magania, including Trojan-GameThief.Win32.Magania.dbtv, to the victim computer.

Malicious programs on the Internet

The second Top Twenty list below shows data generated by the web antivirus component and reflects the online threat landscape. This table includes malware detected on web pages and malware downloaded to victim machines from web pages.

Position Change in position Name Number of attempted downloads
1   New Trojan-Clicker.JS.Iframe.bb   397667  
2   New Exploit.Java.CVE-2010-0886.a   244126  
3   New Trojan.JS.Redirector.cq   194285  
4   New Exploit.Java.Agent.f   108869  
5   New Trojan.JS.Agent.bhr   107202  
6   New Exploit.Java.CVE-2009-3867.d   85120  
7   -2 not-a-virus:AdWare.Win32.FunWeb.q   82309  
8   -6 Exploit.JS.CVE-2010-0806.i   79192  
9   -5 Exploit.JS.CVE-2010-0806.b   76093  
10   New Trojan.JS.Zapchast.dv   73442  
11   -2 Trojan-Clicker.JS.Agent.ma   68033  
12   New Trojan.JS.Iframe.lq   59109  
13   New Trojan-Downloader.JS.Agent.fig   56820  
14   5 not-a-virus:AdWare.Win32.Shopper.l   50497  
15   2 Exploit.JS.CVE-2010-0806.e   50442  
16   -4 Trojan.JS.Redirector.l   50043  
17   New Trojan.JS.Redirector.cj   47179  
18   -2 not-a-virus:AdWare.Win32.Boran.z   43514  
19   -6 Trojan-Dropper.Win32.VB.amlh   43366  
20   New Exploit.JS.Pdfka.chw   42362  

All of the malicious programs listed above have seen changes to their positions.

First place is occupied by Trojan-Clicker.JS.Iframe.bb, which infected almost 400,000 websites during May alone. This Trojan aims to increase website hit counts by making the victim computers visit them without the users’ knowledge or consent.

The new Trojan.JS.Redirector.cq (in 3rd place) redirects visitors to websites distributing rogue antivirus programs.

Seven malicious programs in the Top 20 are exploits. It is remarkable that three newcomers, namely Exploit.Java.CVE-2010-0886.a, Exploit.Java.Agent.f, and Exploit.Java.CVE-2009-3867.d are exploits for the Java platform.

One of them is Exploit.Java.CVE-2010-0886.a which ended up in 2nd place. This malicious program consists of two parts: a downloader written in JavaScript and a Java applet. The downloader uses the launch function from the Java Development Toolkit. This function uses as a parameter a string composed of several parameter keys and the URL where the malicious Java applet is located. The JavaScript code surreptitiously initiates execution of a Java program on the victim computer which in most cases is a Trojan downloader. The downloader in its turn downloads a malicious executable file and launches it on the victim computer. Interestingly, CVE-2010-0886.a gained much of its popularity because it used the Pegel downloader for one of its attacks. A description of Pegel is given in our February statistics overview.

The second newcomer, Exploit.Java.CVE-2009-3867.d is in 6th place. This exploit uses the stack overflow technique by calling the function getSoundBank. This function is used to download media content and expects to get the URL of a soundbank object as its parameter. This vulnerability enables the cybercriminals to use a shell code with which they can then run any code they want to on the victim computer.

The above exploits are typically associated with redirectors and legitimate, but infected, websites. The list of such ‘companion’ malware in May includes Trojan.JS.Agent.bhr (in 5th place), Trojan.JS.Zapchast.dv (in 10th place), Trojan.JS.Iframe.lq (in 12th place) and Trojan-Downloader.JS.Agent.fig (in 13th place).

Countries launching the most web-borne infections:

Conclusion

In recent months cybercriminals have actively used exploits in order to steal users’ confidential data. Changes have been affecting malware propagation techniques and methods that prevent the analysis and detection of malware.

Eleven of May’s Top 20 malicious programs from the Internet are different exploits and their related Trojans. These malicious programs occupy five consecutive Top 20 places starting from 2nd place and then appear on the list in groups of two or three variants.

It is also worth noting that users of Sun software are strongly advised to check for software updates on a regular basis. This advice is given as there is a lot of malware around exploiting the vulnerabilities in the Java platform.


Comments

If you would like to comment on this article you must first
login


Bookmark and Share
Share

Author

Analysis

Blog

Source