Malware Miscellany, May 2008

1. Greediest Trojan targeting banks
   Trojan-Spy.Win32.Banker.mrj comes out as the greediest banking Trojan in May, targeting the clients of 103 banks simulataneously.
2. Greediest Trojan targeting payment systems
   Although Trojan-PSW.Win32.Staem only targets a relatively modest three payment systems, it still comes out top in this category.
3. Greediest malicious program targeting payment cards
   This month, one of the new modifications of Trojan-Spy.Win32.Banker.tq takes the prize, targeting five payment card systems at once – no mean feat for malware in this category!
4. Stealthiest malicious program
   May’s stealthiest piece of malware is from an old family: the winning modification of Backdoor.Win32.Hupigon.bxbu is packed nine times over.
5. Smallest malicious program
   Trojan.Bat.KillWin.dg, in spite of being a minimal 15 bytes in size, is still able to destroy Windows on the user’s disk.
6. Largest malicious program
   Although this month’s winner, Trojan-Spy.Win32.Banker.fgw is a chunky 30MB in size, that’s by no means a record for this category.
7. Most malicious program
   A modification of Backdoor.Win32.Agobot.pgj wins the prize for maliciousness in May, as it combats antivirus solutions by deleting security software from victim machine.
8. Most common malicious program in email traffic
   For the nth time, we’ve got Email-Worm.Win32.Netsky.q leading this cateogory, as it made up 23.12% of all malicious mail traffic in May.
9. Most common Trojan family
   There’s another old-timer here: 3301 new variants of the Backdoor.Win32.Hupigon family appeared in May.
10. Most common virus/ worm family
    This category shows more variation than the preceding two: Net-Worm.Win32.Kolab.c, in 276 modifications, is a new winner of this nomination.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.