Top20 Blocked Malware

The Top 20 malicious programs blocked on PCs

Malware Prevalence Table - September 2013

Let’s review and consider information on the most prevalent families detected in September.

New malicious programs entered the Top 20

September sees new Fake-AV interfaces that supposedly detect hidden threats on a user’s computer.

Fake AV (MD5: cc2fedff4406e3f620b84983057fabbb) is detected by Ad-Aware as Trojan.Win32.Kryptik.acsn

Ransomware continues to blight users, blocking computers and encrypting private data. Lavasoft recently discovered a non-detected crypto locker titled “Anti-Child Porn Protection” that encrypts user’s data demanding a ransom to decrypt them. As described within the locker’s notification window, the ransomware utilizes AES-256, an unbreakable cipher. Bruteforcing is not practical as it needs to cover 1.1x1077 combinations which would take 3.31x1056 years (EETimes) as well, as recovery tools used to restore erased original files like in case of GpCode.ak that used RSA-1024.

Ransomware (MD5:0b06eb1ed254790e38d7b5accc0fe072) is detected by Ad-Aware as Trojan.Win32.Generic

It is worth noting that this ransomware was created in October 2012 - since that date we see no detections on the VirusTotal multi-scanner. It is detected by Ad-Aware Antivirus as Trojan.Win32.Generic and described in the Malware Encylopedia.

Bots Review

Table 1: Bots under analysis (September 2013, Lavasoft MAS).

Aliases*: Generic verdicts were not included.
Autorun: yes*: [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
Autorun: yes**: [HKLM\Software\Microsoft\Windows\CurrentVersion\Run], [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

Bot distribution in September:

Autorun
All the bots analysed exploit the “HKLM\Software\Microsoft\Windows\CurrentVersion\Run” registry key to launch itself when Windows boots up. The Shiz backdoor also uses “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon” in a further attempt to survive a reboot.

DorkBot and Shiz block AV websites preventing users from downloading the latest updates. A recent Dorkbot block list contains 1258 URLs and can be downloaded from one the bots: hxxp://146.185.237.111/va.txt (also available from our mirror.)

Additionally, Shiz and DorkBot use server-side polymorphism to avoid detection.

Recently we found many references on the Internet stating that Kelihos supposedly checks if a victim’s IP is in online blacklists (CBL – composite block list). This information was published by ZScaler Lab and referenced by ThreatPost and hundreds of others news sites.

Unfortunately, we could neither find CBL requests in our database nor reproduce such behavior on the Kelihos sample used by ZScaler (fbad0969a3fe539fa048df9912b8c6d4). In addition, Kelihos uses HTTP protocol to communicate with peers, not SMTP as was noted by ZScaler. The SMTP traffic that highlighted by ZScaler researcher can be explained by spambot activity, which implies numerous connections to SMTP servers. It is possible that the analysts mistakenly attributed blocking replies from SMTP servers as being part of the Kelihos protocol.

SMTP traffic generated by mail servers when Kelihos sends spam

Self-Propagation
The bots can propagate via removable drives (Kelihos uses a vulnerability in LNK files), social networks (DorkBot), Instant Messengers (Dorkbot, Blazebot) and filesharing services, like Dropbox (Blazebot with Rbot). Drive-by attacks and downloading by other malware are also used to deliver a backdoor.

Communication Protocols
HTTP and IRC protocols are the most commonly used nowadays. We noticed that such IRC bots as Dorkbot, Blazebot and Rbot are operating together and probably owned by the same botmaster.

Bot distribution by the type of communication protocol

Rootkit Activity
Four bots out of six (Zbot, Kelihos, DorBot, Shiz) install user-mode hooks into Windows system DLLs in order to spy on user’s activity. Zbot has the highest number of hooks being installed.

Network Activity
All revised bots are still alive, showing network activity and downloading updates.

According to last month’s network activity, Kelihos and Dorkbot were using Amazon’s Cloud Service to host malicious files. In September we found eighty-eight malicious samples that connected to compute.amazonaws.com for bot updates.

The first of such connections made by Kelihos were detected in June 2013 and only continue to grow – it would appear that Amazon's Cloud is becoming popular among bot-masters, being used to increase their botnets.

Amazon Web Services

Top20 Potentially Unwanted Programs

Below are the Top20 Potentially Unwanted Programs blocked by Ad-Aware on user’s PCs. These are advertising software, browser toolbars, search engines and other programs which change browser start pages and other system settings.

Top20 PUPs detected on user’s PC

Operating Systems

Geographic Location

Infections by country of origin

We will keep investigating the epidemiological situation in the world and informing our readers about new malicious code samples in the next Lavasoft Security Bulletin.