Malware Miscellany, September 2008

1. Greediest Trojan targeting banks
   This month, the nomination goes to Trojan-Banker.Win32.Banker.xkz, from the same family that won this category last month. This particular sample targets the users of 28 banks at once.
2. Greediest Trojan targeting payment systems
   September’s winner is Trojan.Win32.Agent.adtp which has its sights set on four e-payment systems simultaneously.
3. Greediest Trojan targeting payment cards
   It’s been a long time since we’ve seen a malicious program which wins out in more than one category. Autumn has brought a surprise entrant, with Trojan-Banker.Win32.Banker.xkz making an appearance in this category as well – in addition to going after 28 banks, it also targets five different payment cards.
4. Stealthiest malicious program
   Autumn has brought about a change in this category – instead of the customary Hupigon, September features a modification of Backdoor.Win32.Netbus.160.e, which is packed with nine different packers.
5. Smallest malicious program
   September’s winner, just like August’s, is 31 bytes in size, but has a different payload – it’s a new modification of Trojan.BAT.MouseDisable.c. And its name tells you everything you need to know – this Trojan will block the mouse.
6. Largest malicious program
   Yet another Trojan-Banker wins the crown in this category: Trojan-Banker.Win32.Banbra.dkj weighs in at 34MB.
7. Most common vulnerability on the Internet
   In September, this category was taken by Exploit.Win32.PowerPlay.a – it made up 6% of all vulnerabilities identified on web pages that were used to deliver malicious code to victim machines.
8. Most common malicious program on the Internet
   Trojan-Downloader.Win32.Small.aacq, which won this category last month as well, still triumphs here; it’s involved in 20% of all cases, which is a pretty high number!
9. Most common Trojan family
   Once again, this category is taken by an old familiar: Backdoor.Win32.Hupigon.c, which came over the finish line in September with 3072 new modifications.
10. Most common virus/ worm family
    There’s also been no change in this category – as we move into autumn, Worm.Win32.AutoRun continues to reign, with 655 new modifications.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.