Malware Miscellany, April 2008

1. Greediest Trojan targeting banks
   Trojan-Spy.Win32.Banker.lax, which targets customers of 104 banks, wins this category in April
2. Greediest Trojan targeting payment systems
   Another variant of Banker, in this case Trojan-Spy.Win32.Banker.krv takes the palm this month. It targets the users of three e-payment systems.
3. Greediest malicious program targeting payment cards
   April’s winner in this category is Trojan-Spy.Win32.Bancos.blc, which has its sights set on three payment card systems at once.
4. Stealthiest malicious program
   This month, one variant of Backdoor.Win32.Hupigon.bqsi wins out, being packed with seven different packers.
5. Smallest malicious program
   The tiny Trojan.BAT.MouseDisable.b, with a mere 22 bytes, still manages once launched to block the mouse.
6. Largest malicious program
   April’s winner is Trojan-Dropper.Win32.Agent.nrh – at 46MB in size, it’s not that large compared to previous victors in this category
7. Most malicious program
   There’s a new entrant in this category – a modification of Backdoor.Win32.Agobot.gen replaces the Haradong family which has ruled for the last two months. Malicious programs from this family search for and destroy antivirus solutions in all possible locations – in RAM, the system registry and on disk.
8. Most common malicious program in email traffic
   In a couple of months we may have to reconsider the value of this category, as it’s been almost exclusively occupied by Email-Worm.Win32.Netsky.q. The worm isn’t conceding ground to any other malicious program, and during the last month it’s even increased its share of infected mail traffic to 40.58%.
9. Most common Trojan family
   Backdoor.Win32.Hupigon remains the most ‘fertile’ malicious program, giving birth to 3151 modifications in the course of a single month – only slightly fewer than last month.
10. Most common virus/ worm family
    Worm.Win32.AutoRun heads this category in April, with 230 new modifications.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.