Monthly Malware Statistics, October 2010
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2010-0806 | Use-After-Free RCE in Microsoft Internet Explorer (CVE-2010-0806) Microsoft Internet Explorer contains a use-after-free (resource management) flaw in which the browser accesses an invalid pointer after an object has been deleted, leaving a dangling pointer. A remote attacker can trigger the flaw by luring a user of a vulnerable Internet Explorer version to attacker-controlled or malicious web content; the dangling-pointer access can be leveraged to execute arbitrary code with the victim user's privileges. Any system still running the affected Internet Explorer builds is exposed; the flaw dates to the 2010 era, when vendor advisories (cumulative update MS10-018, March 2010) addressed it in Internet Explorer 6 and 7, and CISA notes the impacted product may be end-of-life. Exploitation is confirmed in the wild: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2026-05-20 (ransomware use unknown), and EPSS assigns an 82.2% probability of exploitation within 30 days; no public proof-of-concept is cataloged. Do: Apply mitigations per Microsoft's vendor instructions within the BOD 22-01 timeframe, which for affected builds means the MS10-018 (March 2010) cumulative Internet Explorer update; because IE 6/7 (and IE generally) are end-of-life/retired, CISA also permits discontinuing use of the product. Inventory the estate for Internet Explorer 6/7 on legacy Windows XP and embedded or unmanaged systems, and migrate any remaining users to a supported, currently patched browser rather than relying on the retired IE client. | — | 82% | KEV |
| large~100,000 to 1,000,000 residual legacy installations still running vulnerable IE 6/7 builds (out of the hundreds of millions of IE users when the flaw was… | |
| CVE-2010-2568 | Remote Code Execution in Microsoft Windows via Malicious Shortcut (LNK) Parsing CVE-2010-2568 is an input-validation flaw (CWE-20) in how Microsoft Windows parses shortcut files, allowing malicious code to execute when the operating system merely displays the icon of a malicious shortcut (.lnk) file. Triggering requires nothing more than the Windows shell rendering the shortcut's icon — for example when browsing a folder containing the file, a vector widely abused via USB drives and network shares in incidents tied to Stuxnet and Gauss. A successful attacker gains arbitrary code execution with the privileges of the logged-on user, suitable for initial access or lateral movement. All Microsoft Windows systems as listed by CISA are affected; the provided data does not specify exact version ranges. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-09-15), carries a 91.3% EPSS probability of exploitation (100th percentile), and related headlines report Microsoft having to re-issue the fix more than once for Stuxnet-related attacks. Do: Apply Microsoft updates per vendor instructions (CISA's required action); since headlines indicate this LNK fix was re-released multiple times, verify systems carry the latest cumulative Windows updates rather than only the original patch. Until patched, avoid browsing untrusted removable drives or network shares with a shell that renders shortcut icons, and monitor for LNK-delivered malware. | — | 91% | KEV |
| mass≈1 billion+ Windows installations worldwide (unknown share unpatched; legacy versions carry the highest risk) | |
| CVE-2010-2883 | Stack-Based Buffer Overflow in Adobe Acrobat and Reader Allows RCE CVE-2010-2883 is a stack-based buffer overflow (CWE-119) in Adobe Acrobat and Adobe Reader that can be triggered remotely, for example by opening attacker-supplied PDF content. Successful exploitation allows a remote attacker to execute arbitrary code with the privileges of the local user, or to crash the application and cause a denial of service. Anyone running a vulnerable build of Adobe Acrobat or Reader is affected, and this flaw is one of the long-lived 'old Adobe flaws' that malware campaigns have been observed leveraging, as reflected in related reporting on an Asruex Trojan variant and the Spring Dragon APT. Exploitation status is significant for a vulnerability of this age: it is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-08, required action: apply updates per vendor instructions), EPSS assigns an 82.5% probability of exploitation within 30 days (100th percentile), and no public proof-of-concept is currently cataloged; ransomware use is unknown. Do: Apply vendor updates per Adobe's instructions, as required by CISA's KEV listing, and upgrade all Acrobat and Reader installations to a currently patched release. Inventory endpoints for legacy or unsupported Adobe Reader/Acrobat builds and prioritize patching for users who routinely handle untrusted PDFs. Until patched, treat unsolicited PDF attachments with caution and verify sender authenticity; no public PoC is known, but active exploitation is cataloged. | — | 82% | KEV |
| masshundreds of millions of desktop installs (Adobe Reader/Acrobat historically ubiquitous on enterprise and consumer systems) |
Full article1,242 words · extracted from securelist.com · click to collapse
Kaspersky Lab presents its malware rankings for October.
Overall, October was relatively quiet, although there were a few incidents worthy of note. Virus.Win32.Murofet, which infected a large number of PE files, was detected at the beginning of the month. What makes this malware interesting is that it generates links using a special algorithm based on the current date and time on the infected computer. Murofet gets the system’s current year, month, date, and minute, generates two double words, hashes them using md5, adds .biz, .org, .com, .net, or .info, and adds “/forum” to the end of the string. This is then used as a link.
Remarkably, this virus does not infect any other types of executable files. It is closely linked to Zeus: the links Murofet generate are part of the Zeus infrastructure, and bot downloaders are placed on these links. This piece of malware demonstrates just how inventive and eager the Zeus developers are to spread their creation around the world.
Fake archiving programs are becoming increasingly common. They are detected by Kaspersky Lab products as Hoax.Win32.ArchSMS. Once this program launches, the user is asked to send one or more SMSs to a premium-rate number so they can access the contents of an archive. In most cases after a message is sent, the user receives instructions on how to use a torrent tracker and/or a link to it. There are a variety of hoax scenarios, but the result is always the same – the victim ends up spending money and does not get the file s/he wants. This type of fraud is relatively new and only came to light a few months ago. It has attracted a lot of interest from cybercriminals, as data from the Kaspersky Security Network (KSN) shows:
Another noteworthy incident in October was that Microsoft broke its own record for the number of security patches released in a single month. On 12 October, for example, 16 security bulletins were released to cover 49 different vulnerabilities. The previous record was set in August this year, when a total of 34 vulnerabilities were patched. This is a clear sign that cybercriminals are actively exploiting defects in the software giant’s products. For example, when the notorious Stuxnet worm appeared it made use of four unpatched zero-day vulnerabilities. October’s security bulletin took care of a third vulnerability exploited by Stuxnet; one vulnerability still remains unpatched.
Malicious programs detected on users’ computers
The following table shows malicious and potentially unwanted programs that were detected and neutralized on users’ computers.
| Position | Change in position | Name | Number of infected computers |
| 1 |  0 |
Net-Worm.Win32.Kido.ir | 386141 |
| 2 |  0 |
Virus.Win32.Sality.aa | 150244 |
| 3 |  0 |
Net-Worm.Win32.Kido.ih | 141210 |
| 4 |  0 |
Trojan.JS.Agent.bhr | 104094 |
| 5 |  0 |
Exploit.JS.Agent.bab | 85185 |
| 6 |  1 |
Virus.Win32.Virut.ce | 81696 |
| 7 |  8 |
Packed.Win32.Katusha.o | 74879 |
| 8 |  -2 |
Worm.Win32.FlyStudio.cu | 73854 |
| 9 |  2 |
Virus.Win32.Sality.bh | 57624 |
| 10 |  -1 |
Exploit.Win32.CVE-2010-2568.d | 54404 |
| 11 |  1 |
Exploit.Win32.CVE-2010-2568.b | 51485 |
| 12 |  -2 |
Trojan-Downloader.Win32.VB.eql | 49570 |
| 13 |  0 |
Worm.Win32.Autoit.xl | 43618 |
| 14 |  0 |
Worm.Win32.Mabezat.b | 43338 |
| 15 |  5 |
Trojan-Downloader.Win32.Geral.cnh | 39759 |
| 16 |  1 |
Worm.Win32.VBNA.b | 33376 |
| 17 |  -1 |
Trojan-Dropper.Win32.Sality.cx | 30707 |
| 18 |  New |
Trojan.Win32.Autoit.ci | 29835 |
| 19 |  New |
Trojan-Dropper.Win32.Flystud.yo | 29176 |
| 20 |  New |
Worm.Win32.VBNA.a | 26385 |
There have been no dramatic changes in the rankings since last month. Kido, Sality, Virut, and CVE-2010-2568 still lead the pack. The only other thing worth mentioning is the increase in the number of Packed.Win32.Katusha.o detections (in 6th place). It is used by cybercriminals to protect and spread fake antivirus programs. Worm.Win32.VBNA.a (in 20th place) is similar to Packed.Win32.Katusha.o except it is written in Visual Basic, a high-level programming language. Both packers have been described in detail in earlier editions of our monthly rankings.
Malicious programs on the Internet
The second Top Twenty list below shows data generated by the web antivirus component and reflects the online threat landscape. This table includes malware and potentially unwanted programs which are detected on web pages or downloaded to victim machines from web pages.
| Position | Change in position | Name | Number of attempted downloads |
| 1 |  New |
Trojan.JS.FakeUpdate.bp | 114639 |
| 2 |  -1 |
Exploit.JS.Agent.bab | 96296 |
| 3 |  8 |
Exploit.Java.CVE-2010-0886.a | 89012 |
| 4 |  New |
Hoax.Win32.ArchSMS.jxi | 78235 |
| 5 |  1 |
Trojan.JS.Agent.bhr | 63204 |
| 6 |  -2 |
AdWare.Win32.FunWeb.di | 62494 |
| 7 |  New |
Trojan.JS.Redirector.nj | 61311 |
| 8 |  -3 |
AdWare.Win32.FunWeb.ds | 52404 |
| 9 |  New |
Trojan.JS.Agent.bmx | 35889 |
| 10 |  3 |
AdWare.Win32.FunWeb.q | 34850 |
| 11 |  -1 |
AdWare.Win32.FunWeb.fb | 34796 |
| 12 |  New |
Trojan-Downloader.Java.Agent.hx | 34681 |
| 13 |  New |
Exploit.JS.CVE-2010-0806.i | 33067 |
| 14 |  1 |
Exploit.JS.CVE-2010-0806.b | 31153 |
| 15 |  New |
Trojan-Downloader.Java.Agent.hw | 30145 |
| 16 |  New |
Trojan.JS.Redirector.lc | 29930 |
| 17 |  New |
Exploit.Win32.CVE-2010-2883.a | 28920 |
| 18 |  -6 |
Trojan-Downloader.Java.Agent.gr | 27882 |
| 19 |  -3 |
AdWare.Win32.FunWeb.ci | 26833 |
| 20 |  New |
AdWare.Win32.FunWeb.ge | 25652 |
There have been no substantial changes to the rankings this month – exploits for CVE-2010-0806 and the FunWeb adware family continue to dominate. However, a few unusual pieces of malware have emerged that are worth taking a closer look at.
Exploit.Win32.CVE-2010-2883.a (seventeenth place), which exploits the vulnerability of the same name, was first identified a little over a month ago. Cybercriminals obviously wasted no time in exploiting this vulnerability. The vulnerability relates to an Adobe Reader DLL called cooltype.dll, which will incorrectly process a specially crafted font file. A look at the geographic distribution of Exploit.Win32.CVE-2010-2883.a shows that it was detected most often in the USA, the UK and Russia. It appears that cybercriminals assumed these countries would host the largest number of computers with unpatched Adobe Reader software.
The malicious script Trojan.JS.Redirector.nj (seventh place) is found on certain porn sites and displays a message asking the user to send an SMS to a premium-rate number in order to use the site. The script is crafted in such a way that Task Manager or a program with similar functionality has to be used in order to close the page.
The message displayed by Trojan.JS.Redirector.nj prompts
the user to send an SMS to access the required site
Trojan.JS.Agent.bmx (in 9th place) is a classic browser exploit; it downloads a Trojan- Downloader which in turn gets a list of as many as 30 links leading to various malicious programs, including Trojan-GameThief.Win32.Element, Trojan-PSW.Win32.QQShou, Backdoor.Win32.Yoddos, Backdoor.Win32.Trup, Trojan-GameThief.Win32.WOW and others.
FakeUpdate – Trojan.JS.FakeUpdate.bp, a script from the FakeUpdate family, is at the top of the ranking. It is also found on porn sites and offers the user the opportunity to download a video clip. However, when an attempt is made to play the clip, a popup window appears saying a new media player has to be installed in order to watch the clip.
The popup displayed by Trojan.JS.FakeUpdate.bp prompts the user
to install a media player so they can watch video clips on a porn site
Analysis has shown that the installer contains a Trojan along with the legitimate Fusion Media Player application. The Trojan modifies the “hosts” files, associating a number of popular sites with 127.0.0.1, the local IP address, and then installs a local web server on the infected computer. After this, every time the user tries to access one of the sites, a page appears in the browser demanding that the user pay for viewing adult content.
The page displayed instead of the site bash.org.ru reads: “You have been watching gay porn”.
The user is asked to send an SMS to pay for the service and to receive a code that will remove the message
The other newcomers may not be quite as interesting, but they are still worth mentioning. Two new Java downloaders – Trojan-Downloader.Java.Agent.hx (12th place) and Trojan-Downloader.Java.Agent.hw (15th place) use openStream (class URL) methods to download other malicious programs. Hoax.Win32.ArchSMS.jxi (3rd place) belongs to the same family mentioned above. Even though there were no major incidents to talk of this month, there was still plenty of new and interesting malicious programs out there.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/monthly-malware-statistics-october-2010/36327/