Monthly Malware Statistics: August 2010
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2010-0806 | Use-After-Free RCE in Microsoft Internet Explorer (CVE-2010-0806) Microsoft Internet Explorer contains a use-after-free (resource management) flaw in which the browser accesses an invalid pointer after an object has been deleted, leaving a dangling pointer. A remote attacker can trigger the flaw by luring a user of a vulnerable Internet Explorer version to attacker-controlled or malicious web content; the dangling-pointer access can be leveraged to execute arbitrary code with the victim user's privileges. Any system still running the affected Internet Explorer builds is exposed; the flaw dates to the 2010 era, when vendor advisories (cumulative update MS10-018, March 2010) addressed it in Internet Explorer 6 and 7, and CISA notes the impacted product may be end-of-life. Exploitation is confirmed in the wild: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2026-05-20 (ransomware use unknown), and EPSS assigns an 82.2% probability of exploitation within 30 days; no public proof-of-concept is cataloged. Do: Apply mitigations per Microsoft's vendor instructions within the BOD 22-01 timeframe, which for affected builds means the MS10-018 (March 2010) cumulative Internet Explorer update; because IE 6/7 (and IE generally) are end-of-life/retired, CISA also permits discontinuing use of the product. Inventory the estate for Internet Explorer 6/7 on legacy Windows XP and embedded or unmanaged systems, and migrate any remaining users to a supported, currently patched browser rather than relying on the retired IE client. | — | 82% | KEV |
| large~100,000 to 1,000,000 residual legacy installations still running vulnerable IE 6/7 builds (out of the hundreds of millions of IE users when the flaw was… | |
| CVE-2010-2568 | Remote Code Execution in Microsoft Windows via Malicious Shortcut (LNK) Parsing CVE-2010-2568 is an input-validation flaw (CWE-20) in how Microsoft Windows parses shortcut files, allowing malicious code to execute when the operating system merely displays the icon of a malicious shortcut (.lnk) file. Triggering requires nothing more than the Windows shell rendering the shortcut's icon — for example when browsing a folder containing the file, a vector widely abused via USB drives and network shares in incidents tied to Stuxnet and Gauss. A successful attacker gains arbitrary code execution with the privileges of the logged-on user, suitable for initial access or lateral movement. All Microsoft Windows systems as listed by CISA are affected; the provided data does not specify exact version ranges. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-09-15), carries a 91.3% EPSS probability of exploitation (100th percentile), and related headlines report Microsoft having to re-issue the fix more than once for Stuxnet-related attacks. Do: Apply Microsoft updates per vendor instructions (CISA's required action); since headlines indicate this LNK fix was re-released multiple times, verify systems carry the latest cumulative Windows updates rather than only the original patch. Until patched, avoid browsing untrusted removable drives or network shares with a shell that renders shortcut icons, and monitor for LNK-delivered malware. | — | 91% | KEV |
| mass≈1 billion+ Windows installations worldwide (unknown share unpatched; legacy versions carry the highest risk) |
Full article1,225 words · extracted from securelist.com · click to collapse
In August, there was a significant increase in exploits of the CVE-2010-2568 vulnerability. Worm.Win32.Stuxnet, which notoriously surfaced in late July, targets this vulnerability, as does the Trojan-Dropper program which installs the latest variant of the Sality virus – Virus.Win32.Sality.ag. Unsurprisingly, black hats lost no time in taking advantage of this latest vulnerability in the most commonly used version of Windows. However, on 2 August Microsoft released MS10-046 which provides a patch for the vulnerability. This update was rated ‘Critical’, meaning it should be installed as soon as possible on all computers running the vulnerable operating system.
Malicious programs detected on users’ computers
The first Top Twenty ranking shown below lists malware, adware and potentially unwanted programs that were detected and neutralized by the on-access scanner when they were accessed for the first time.
| Position | Change in position | Name | Number of infected computers |
| 1 |  0 |
Net-Worm.Win32.Kido.ir | 280087 |
| 2 |  0 |
Virus.Win32.Sality.aa | 172770 |
| 3 |  0 |
Net-Worm.Win32.Kido.ih | 153825 |
| 4 |  0 |
Net-Worm.Win32.Kido.iq | 107156 |
| 5 |  1 |
Trojan.JS.Agent.bhr | 106796 |
| 6 |  -1 |
Exploit.JS.Agent.bab | 90465 |
| 7 |  0 |
Worm.Win32.FlyStudio.cu | 75394 |
| 8 |  0 |
Virus.Win32.Virut.ce | 68010 |
| 9 |  new |
Exploit.Win32.CVE-2010-2568.d | 52193 |
| 10 |  -1 |
Trojan-Downloader.Win32.VB.eql | 48440 |
| 11 |  new |
P2P-Worm.Win32.Palevo.arxz | 42145 |
| 12 |  new |
Exploit.Win32.CVE-2010-2568.b | 40385 |
| 13 |  -3 |
Worm.Win32.Mabezat.b | 38252 |
| 14 |  new |
Worm.Win32.VBNA.b | 37461 |
| 15 |  new |
AdWare.WinLNK.Agent.a | 37240 |
| 16 |  new |
Virus.Win32.Sality.ag | 36144 |
| 17 |  new |
Trojan-Dropper.Win32.Sality.r | 32352 |
| 18 |  new |
Trojan.Win32.Autoit.ci | 31391 |
| 19 |  -8 |
Trojan-Dropper.Win32.Flystud.yo | 29475 |
| 20 |  new |
Packed.Win32.Krap.ao | 29309 |
As in July, the top half of the ranking remains virtually unchanged, with the exception of a few small changes.
Kido (aka Conficker) remains in first, third and fourth place, while the file infectors Virus.Win32.Virut.ce (eighth place) and Virus.Win32.Sality.aa (second place) have also held on to their positions. Trojan.JS.Agent.bhr (fifth place) and Exploit.JS.Agent.bab (sixth place) have also maintained their positions, merely swapping places.
The July rankings mentioned a new vulnerability in Windows LNK shortcuts, which was later dubbed CVE-2010-2568. As expected, cybercriminals started actively exploiting this vulnerability: the August rankings include three pieces of malware which are linked to CVE-2010-2568 in one way or another. Two of these – Exploit.Win32.CVE-2010-2568.d (ninth place) and Exploit.Win32.CVE-2010-2568.b (twelfth place) – directly exploit the vulnerability while the third, Trojan-Dropper.Win32.Sality.r (seventeenth place), uses it to propagate. It generates vulnerable LNK shortcuts with names designed to attract attention and spreads these across local networks. The malware is launched when a user opens a folder containing one of these shortcuts. The main function of Trojan-Dropper.Win32.Sality.r is to install the latest modification of Virus.Win32.Sality.ag (sixteenth place).
Trojan-Dropper.Win32.Sality.r code showing shortcut names created by the malware
Curiously, both the exploits for CVE-2010-2568 which are included in the ranking are often found in Russia, India and Brazil. While India is the primary source of the Stuxnet worm (the first malicious program to target this vulnerability), it is not entirely clear what role Russia plays.
The geographical distribution of Trojan-Dropper.Win32.Sality.r matches that of the exploits.
Geographical distribution of Exploit.Win32.CVE-2010-2568.d
Another newcomer to the ranking is a piece of adware – this time, AdWare.WinLNK.Agent.a (fifteenth place). This is a shortcut which, when launched, takes the user to a URL specified in an advertising link. The shortcut is installed by various adware programs.
Trojan.Win32.Autoit.ci, a new representative of the malware family which uses the AutoIt scripting language appeared on the ranking in August in eighteenth place. Other newcomers included a new modification of the Palevo P2P worm P2P-Worm.Win32.Palevo.arxz (eleventh place). Both malware families have been covered in previous reports, and they have wide-ranging payloads, including autorun functions, the ability to download and launch other malicious programs, and to spread over local networks.
The ranking also features two malicious packers: Packed.Win32.Krap.ao (twentieth place) makes its first appearance, whereas Worm.Win32.VBNA.b (fourteenth place) featured in the June rankings. Both programs are used to protect malware from being detected by security software, and can be used to pack virtually any malicious programs, from rogue antivirus software to complex backdoors, such as Backdoor.Win32.Blakken.
Malicious programs on the Internet
The second Top Twenty list below shows data generated by the web antivirus component and reflects the online threat landscape. This table includes malware and potentially unwanted programs which are detected on web pages or downloaded to victim machines from web pages.
| Position | Change in position | Name | Number of attempted downloads |
| 1 |  new |
Trojan-Downloader.Java.Agent.ft | 135755 |
| 2 |  -1 |
Exploit.JS.Agent.bab | 127561 |
| 3 |  9 |
Exploit.HTML.CVE-2010-1885.a | 85502 |
| 4 |  2 |
Trojan.JS.Agent.bhr | 67061 |
| 5 |  4 |
AdWare.Win32.FunWeb.ds | 60129 |
| 6 |  new |
Exploit.HTML.CVE-2010-1885.c | 57988 |
| 7 |  new |
AdWare.Win32.FunWeb.di | 50928 |
| 8 |  -4 |
AdWare.Win32.FunWeb.q | 50504 |
| 9 |  new |
Exploit.HTML.HCP.b | 46874 |
| 10 |  -6 |
Exploit.Java.CVE-2010-0886.a | 45844 |
| 11 |  -5 |
Trojan-Downloader.VBS.Agent.zs | 37578 |
| 12 |  8 |
Trojan.JS.Redirector.cq | 37479 |
| 13 |  new |
Trojan-Clicker.JS.Iframe.fq | 35181 |
| 14 |  5 |
AdWare.Win32.FunWeb.ci | 33073 |
| 15 |  new |
Exploit.Java.CVE-2010-0094.a | 30062 |
| 16 |  new |
Exploit.JS.Pdfka.cop | 29588 |
| 17 |  new |
Exploit.HTML.CVE-2010-1885.d | 28396 |
| 18 |  new |
Exploit.JS.CVE-2010-0806.b | 26990 |
| 19 |  new |
AdWare.Win32.FunWeb.fb | 26350 |
| 20 |  new |
Exploit.HTML.CVE-2010-1885.b | 25820 |
Compared to recent months, there are relatively few (ten in all) newcomers to the August rankings. All of these are new modifications of exploits which target already known vulnerabilities. Overall, this month’s rankings include twelve exploits which target six different vulnerabilities.
This month, cybercriminals focused their efforts on exploiting CVE-2010-1885. Five exploits listed in the ranking target this vulnerability: Exploit.HTML.CVE-2010-1885.a (third place), Exploit.HTML.CVE-2010-1885.c (sixth place), Exploit.HTML.HCP.b (ninth place), Exploit.HTML.CVE-2010-1885.d (seventeenth place) and Exploit.HTML.CVE-2010-1885.b (twentieth place). In contrast, the July rankings only listed one such exploit. CVE-2010-1885 is associated with a error in Windows Help and Support Center which makes it possible to run malicious code on systems running Windows XP and Windows 2003. It seems likely that the popularity of these two operating system versions led to the increasing number of exploits.
CVE-2010-0806 has been almost as widely exploited as CVE-20100-1885; the ranking include three different exploits which target this vulnerability. Two of them are scripts which have been covered in previous reports: namely Exploit.JS.Agent.bab (second place) and Trojan.JS.Agent.bhr (fourth place). The latest addition is Exploit.JS.CVE-2010-0806.b (eighteenth place).
Three more exploits in of the rankings target vulnerabilities in software using a Java engine. First place is taken by Trojan-Downloader.Java.Agent.ft which exploits CVE-2009-3867 – this vulnerability is quite old and was covered in the May report. Exploit.Java.CVE-2010-0886.a (tenth place), which exploits CVE-2010-0886 has stayed in the rankings since last month. Interestingly, CVE-2010-0094 was detected back in early April 2010, and the first exploit emerged this August. Exploit.Java.CVE-2010-0094.a (fifteenth place) successively calls a number of functions which ultimately lead to the execution of malicious code.
Fragment of Exploit.Java.CVE-2010-0094.a which exploits the vulnerability
In August, this exploit was only used by cybercriminals in developed countries – the USA, Germany, and the UK. This may be related to the fact that programs using Java are popular in these countries.
Geographical distribution of Exploit.Java.CVE-2010-0094.a
Exploit.JS.Pdfka.cop in sixteenth place is another exploit, this time a fairly standard one; it relies on using the peculiarities of PDF documents to execute malicious code.
Trojan-Clicker.JS.Iframe.fq (thirteenth place) is a new addition, and falls into the category of malicious scripts which redirect victim browsers to a malicious link using the HTML tag “”. Two more malicious scripts are Trojan-Downloader.VBS.Agent.zs (eleventh place) and Trojan.JS.Redirector.cq (twelfth place); both were discussed in last month’s review.
Adware is as popular as ever. AdWare.Win32.FunWeb has superseded Shopper.l and Boran.z which were its competitors in July. Five representatives of the FunWeb family were present in the August rating. Three of those modifications (“ds”, “ci”, “q”, occupying fifth, fourteenth, and eighth places respectively) were in the July rankings, while “fb” and “di” (nineteenth and seventh places) made it to the rankings for the first time in August.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/monthly-malware-statistics-august-2010/36317/