Top20 Blocked Malware 

The Top 20 malicious programs blocked on PCs

Compared to the previous month, July sees the changes in the positions of generic detections and viruses.

A new modification of Email-Worm.Win32.Brontok.ik entered the Top 20 in June, as well as Win32.Backdoor.Zaccess we talked about in our previous post and new generic detection – Trojan.Win32.Generic!SB.0.

Worm.Win32.Chir.D is an oldbie. The worm has virus-like capabilities to infect Windows executable files. It spreads via email attachments as well as all available logical and network drives. In addition, it exploits incorrect MIME header causing IE to execute e-mail attachment (MS01-020). Attackers search the infected PC for htm and html files and write javascript to run an eml file with the worm’s body to the end of the files found. The eml file is located in the folder htm and html files have been found in.

HackTool.Win32.Keygen. The family of malicious programs presents hacker utilities to generate the activation code for different paid programs. As a rule, attackers embed additional malicious functionality into such programs to ensure the user will unknowingly run a malicious program on the PC if he/she does not want to use legal software.

HackTool.Win32.Keygen

 New Incomings to the Lab

Let’s review and consider information on the number of unique files with the same detection name.

New malicious programs entered the Top 20

The top positions are still occupied by fake antiviruses: Trojan.Win32.Winwebsec.fd and Trojan.Win32.Fakeav.rm. They belong to the family of Trojan programs imitating legitimate antivirus program. Such programs ask the user to pay money to register the software to remove non-existing threats. All fake antiviruses are designed to resemble legitimate antivirus programs. See the examples below:

Example 1: FakeAV

Example 2: FakeAV

Nrgbot (Trojan.Win32.Generic!BT) is a multifunctional irc bot. The number of the bots has started to increase in 2011. When the Dorkbot builder became open to the public, the bot popularity among attackers continued to increase.

Dorkbot builder

According to ESET researchers in Latin America, 81000 computers are infected by Dorkbot (Nrgbot).

Hacking Yahoo

In July, the D33Ds Co hacker team (supposedly originated from Ukraine) published a text file containing 453 491 emails with user passwords for a wide Internet audience to prove their penetration to Yahoo! Voice service. The hack was done by union-based sql injection. In the report, the hackers noticed an interesting fact that the stolen passwords had been stored in a database unencrypted. It sounds strange if talking about the security of Yahoo! online services.

The Middle East Cyberwar

In July 2012 Kaspersky Lab and Seculert announced that they had discovered a new malicious program called "Mahdi" (a spiritual and temporal leader who will rule before the end of the world and restore religion and justice) that is involved in The Middle East cyberwar.

We already have heard about such malware as Stuxnet written in June 2009, Duqu appeared in November 2010 and Flame which was detected in May 2012.

According to New York Times , the Stuxnet project was initiated by US and Israel government within George W. Bush "Olympic Games" project to spin Iran’s nuclear centrifuges at Natanz nuclear plant out of control.

The Duqu virus was designed to steal nuclear program documentation and has the same program platform as Stuxnet. Thus, it might be created by the same team of programmers.

Like Duqu, Flame is a sophisticated backdoor tool designed to steal confidential data being able to eavesdrop using an internal microphone. The peculiarity of Flame is its huge size – around 20 MB and ability to use Bluetooth to collect information about nearby devices. But American officials state that the virus is not a part of "Olympic Games".

According to Kaspersky Lab researchers, the new "Mahdi" makes screenshots from the users who are visiting websites with "USA" and "gov" keywords. The list of keywords also contains the popular social services, such as: facebook, google, yahoo!, gmail, myspace, msn messenger, and even Russian social network vkontakte. It uploads stolen data without any command received from the server to C&C in Montreal, Canada.

Mahdi also uses social engineering techniques to spread and hide dropper’s activity. One of such evasive technique is sending PowerPoint presentations with active content to start downloading malicious files while a user is looking at wild nature pictures and listening to music "Ernesto Cortazar - You are my Destiny". For instance, Moses_pic1.pps (1556992 bytes in size, MD5: 362600f55f0266b38bbdb5af68ede3aa) contains the following pictures:

 Another example "Magic_Machine1123.pps"(2340352 bytes in size, MD5: 87161e29401aea799ae4cbbabcc3be17) presents math puzzle:

Sometimes it shows video to draw user’s attention away from downloading malicious files.

In addition, F-Secure has recently published a letter from an anonymous scientist working at the Atomic Energy Organization of Iran (AEOI). He noticed that Iranian nuclear systems were attacked by yet another worm. The interesting fact is that infected machines were playing AC/DC "Thunderstruck" song at midnight.

It is hard to say whether all these attacks to Iran are connected and sponsored by governments within the "Olympic Games" project, but it is obvious that Iran’s nuclear infrastructure is targeted by very sophisticated malware for the last couple of years. And such attempts seem to have been succeeded so far. We can expect appearing new malware that will continue attacking nuclear plants and academic institution in Iran to slow down their efforts in national nuclear program.

Top20 Potentially Unwanted Programs

Below is Top20 Potentially Unwanted Programs blocked by Ad-Aware on user’s PCs. These are advertising software, browser toolbars, search engines and other programs which change browser start pages and other system settings.

Top20 PUPs detected on user’s PC

See below examples of PUPs collected by our laboratory:

Example1: PUPs

Example 2: PUPs

Example 3: PUPs

Operating Systems

Infections by OS

Geographic Location

Infections by country of origin

We will keep investigating the epidemiological situation in the world and informing our readers about new malicious code samples in the next Lavasoft Security Bulletin.