Malware Miscellany, March 2008

1. Greediest malicious program targeting banks
   As we move into spring, this category is taken by one modification of Trojan-Spy.Win32.Banker.zq, which targets 109 banks simultaneously – a huge rise on last month’s Banker.cji, which targeted 44 banks.
2. Greediest malicious program targeting payment systems
   March’s winner in this category is Trojan-Spy.Win32.Banker.etk, which has its sights set on a comparatively modest three payment systems.
3. Greediest malicious program targeting payment cards
   Another member of the Banker family, Trojan-Spy.Win32.Banker.enw takes the crown this month, targeting the users of four different payment systems at once.
4. Stealthiest malicious program
   If you’re a regular reader of this column, you’ll know that malware packed with ten different packers is nothing rare. And this month gives us yet another example: Trojan-Downloader.Win32.Delf.ain.
5. Smallest malicious program
   Get your magnifying glasses out for this month’s winner – Trojan.BAT.FormatC.r which weighs in at a mere 16 bytes, but still to wipe your C: disk
6. Biggest malicious program
   For the second month in a row this category is taken by a member of the Haradong family; in this case it’s Trojan.Win32.Haradong.fj, which weighs in at 305MB, 79MB larger than last month’s entrant.
7. Most malicious program
   With the transition to spring, the leader in this category has changed. March’s winner is Backdoor.Win32.Rbot.gen, and given the nasty nature of the Rbot family, this comes as no surprise. The programs covered by this detection use a number of methods to disable a range of antivirus solutions.
8. Most common malicious program in email traffic
   No changes here this month – once again we’ve got Email-Worm.Win32.Netsky.q leading, making up 37.39% of all infected mail traffic, slightly up on last month’s 36%.
9. Most common Trojan family
   March’s winner is Backdoor.Win32.Hupigon – we detected a stunning 3381 modifications of this family in March!
10. Most common virus/ worm family
    This category has something slightly new for March: Net-Worm.Win32.Kolab dominates this particular category with 35 modifications.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.