Malware Miscellany, November 2008

• Greediest Trojan targeting banks
  Trojan-Spy.Win32.Egoldan.az targets the users of 20 banking systems (a relatively low number when compared to previous winners of this category.)
• Greediest Trojan targeting payment systems and payment cards
  Trojan.Win32.Obfuscated.gen wins both categories in November by targeting 4 payments systems and 3 payment card systems simultaneously.
• Stealthiest malicious program
  Trojan-PSW.Win32.LdPinch.beo is packed with 9 different utilities.
• Smallest malicious program
  The 22 bytes of Trojan.BAT.Shutdown.g enable it to automatically launched and then force the victim machine into constantly rebooting.
• Largest malicious program
  Trojan-Banker.Win32.Banker.kum is 19MБ in size, which is very small in comparison with previous winners of this category.
• Most widespread malicious code which exploits a vulnerability
  Exploit.JS.RealPlr.nn made up more than 8% of all malicious content in December.
• Most common malicious program on the Internet
  Trojan-Downloader.JS.Iframe.yv was responsible for 4% of all malicious content detected on the web during November 2008.
• Most common Trojan program
  There were 1723 new modifications of Trojan.Win32.Agent this month.
• Most common virus/ worm family
  Again, Worm.Win32.AutoRun wins this category, but with only 337 new modifications – a significant increase on October’s 75 new modifications.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.