Malware Trend Report, Q January February March

Transcription

1 Malware Trend Report, Q1 215 January February March April 215 Copyright RedSocks B.V All Rights Reserved.

2 This page is left blank on purpose. Page 1

3 Table of Contents 1. Introduction Summary Data Breaches and Security News Methodology Collecting Malware Processing Malware Detecting Malware Classifying Malware Trends Backdoors Exploits Rootkits Trojans Worms Bit Malware Others Geolocation Final Word...3 Appendix A: Detecting Malware...31 Appendix B: Classifying Malware...29 Appendix C: Fastest Growing C&C Hosting Countries...32 Page 2

4 Table of Figures Figure 1: Unique New Malicious Files Q Figure 2: Distribution New Malicious Files Q Figure 3: Storing New Malicious Files Q Figure 4: Detection by Anti-Virus Engines...11 Figure 5: Anti-Virus Detection Percentage Q Figure 6: Files Identified as Backdoor Q Figure 7: Distribution of Backdoors Q Figure 8: Distribution of Variations of Backdoor.Bot Q Figure 9: Files Identified as Exploits Q Figure 1: Distribution of Exploits Q Figure 11: Distribution of CVE C Q Figure 12: Files Identified as Rootkit Q Figure 13: Distribution of Rootkits Q Figure 14: Distribution of Variations of Rootkit.1562 Q Figure 15: Files Identified as Trojan Q Figure 16: Distribution of Trojans Q Figure 17: Distribution of Trojan Downloaders Q Figure 19: Upatre Trojan Download Family Q Figure 18: Distribution of Trojan Droppers Q Figure 2: Distribution of PWS Trojans Q Figure 21: Distribution of Spy Trojans Q Figure 22: Files Identified as Worm...23 Figure 23: Distribution of Worms Q Figure 24: Files Identified with 64-Bit Malware...24 Figure 25: Distribution of 64-Bit Malware Q Figure 26: 64-Bit Malware Families Q Figure 27: Files Identified as Other Malware...26 Figure 28: Distribution of Other Malware Q Figure 29: Sum of the Top 1 C&C Hosting Countries...28 Figure 3: Top 1 C&C Hosting Countries Q Page 3

5 1. Introduction This is the first quarterly trend report for 215 from the RedSocks Malware Research Lab. RedSocks is a 1 percent Dutch company specializing in malware detection. Our product, the RedSocks Malware Threat Defender, is a network appliance that analyses digital traffic flows in real-time, based on algorithms and lists of malicious indicators. This critical information is compiled by the RedSocks Malware Intelligence Team (RSMIT). The team consists of specialists whose job is to identify new threats and trends on the Internet and to translate them into state-of-the-art malware detection capabilities. With this report we hope to provide the reader with a deeper insight into the trends we see in the malware we process as we look at data collected during the first quarter of 215. At RedSocks we analyse large numbers of malicious files on a daily basis, therefore we can only cover a few topics briefly in this trend report. Protecting your data from Internet-based threats is not an easy task, and relying solely on protection from Anti-Virus companies - no matter how established their brand - is not enough. Comprehensive protection requires an entirely new approach. Page 4

6 2. Summary In the first quarter of 215, almost 2 million, new and unique malicious files were processed in the RedSocks Malware Labs. 7 Million in January, 6 million in February, and up to 7 million again in March. Compared with the last quarter of 214, that is a drop of 14 percent. This quarter the overall detection by Anti-Virus software was only percent, which is a drop of percent when compared to the fourth quarter of 214. The detection rate for January was percent. For February, it was percent and in March, the average detection was only percent. Please note that identification rates can change based on samples chosen, scanning engines used and time of scanning. During the first quarter the amount of unique files identified as backdoors was 125., which is a 63 percent decrease when compared to the amount of files found in the last quarter of 214. The Anti-Virus software detected 5,217 exploits and 7,619 rootkits in the first quarter of this year. The identified exploits dropped by 54 percent, and the rootkits dropped by 4 percent when compared to the amount of unique files from the last quarter of 214. Trojans were by far the most popular type of malware. In January, 1.6 million were identified, in February 1. million and in March, 1.5 million, which is a decrease of 39 percent when compared to the amount of trojan files found in the last quarter 214. In January, 74, worm files were identified. In February the number increased to 123,. In March, 11, worms were added to our databases. Compared with the 64. worms from Q4 214, that is a drop of 52 percent. Grouped together, all other malicious files - such as flooders, hacktools, spoofers, spyware, viruses, etc. - make up for 651,, 939, and 1.2 million of the total for January, February and March, respectively, which is a decrease of 48 percent when compared to the amount of files found in the fourth quarter of 214. Within the top 1 countries hosting C&C servers, there was little change. But the amount of new C&C servers increased by 148 percent when compared to the last quarter of 214. A total of 17,325 active C&C servers were found and added to our blacklist in the first quarter of this year (3,738 in January, 3,484 February, and 1,13 in March). In March we see C&C servers for the first time in 43 countries that did not have any in January or February. Jordan, with 73 C&C servers, is one of those countries. The Netherlands dropped to 8 th place in the first quarter. The amount of new C&C servers hosted in The Netherlands doubled in March, to 378. Page 5

7 2.1. Data Breaches and Security News On January 2nd, the hacker group Rex Mundi published thousands of personal data from Dutch and Belgians. Including passwords, bank data and medical records. The Rex Mundi group is known for hacking Domino's Pizza, Telecom Numericable and the Dutch employment agency Accord. The group extorted the hacked companies and published large amounts of data on Pastebin and Dpaste. (Source: in Dutch) According to Paul Moore, a UK-based IT security consultant, the Immobilise website was affected by what he initially believed to be a direct object reference vulnerability. The bug exposed names, addresses, phone numbers, addresses and details on registered items (serial numbers, IMEIs, unique marks, value), information that can be highly valuable for burglars and other malicious actors. (Source: On February 1th, Rijksoverheid.nl and many other government websites were targeted by a DDoS attack. The outage began on Tuesday, February 1th at 1: am and lasted into the evening. Telfort.nl and GeenStijl.nl were also offline. (Source: in Dutch) Colleagues at Kaspersky Labs published and excellent in-depth research about the Equation group. The Equation group uses multiple malware platforms, some of which surpass the wellknown Regin threat in complexity and sophistication. The Equation group is probably one of the most sophisticated cyber-attack groups in the world. (Source: Dubbed the "FREAK" vulnerability (CVE ) - also known as Factoring Attack on RSA- EXPORT Keys - enables hackers or intelligence agencies to force clients to use older, weaker encryption i.e. also known as the export-grade key or 512-bit RSA keys. FREAK vulnerability discovered in March by security researchers of French Institute for Research in Computer Science and Automation (Inria) and Microsoft, resides in OpenSSL versions 1.1k and earlier, and Apple's Secure Transport. (Source: Page 6

8 In the last week of March, a 13-year-old SSL/TLS Weakness Exposing Sensitive Data in Plain Text attack, dubbed "Bar-Mitzvah", can be carried out even without conducting man-in-themiddle attack (MITM) between the client and the server, as in the case of most of the previous SSL hacks. The attack leverages a 13-year-old weakness in the less secure Rivest Cipher 4 (RC4) encryption algorithm, which is the most commonly used stream cipher for protecting 3 percent of TLS traffic on the Internet today. (Source: Page 7

9 3. Methodology 3.1. Collecting Malware At the RedSocks Malware Research Labs, we track large numbers of malware from our globaldistributed honeypots, honey-clients, spam-nets and various botnet monitoring sensors. Due to the distribution of our honeypots we are able to automatically collect and process new malicious samples from across the globe. We also exchange large quantities of malicious files with the Anti-Virus industry. Unique New Malicious Files January February March October November December January February March Q1-214 Q4-214 Q Figure 1: Unique New Malicious Files Q1-215 In the first quarter of 215, we processed a total of 19,983,354 unique and new malicious samples. This is percent of the total from Q1-214 and percent compared with Q Page 8

10 Distribution New Malicious Files Q /1/215 4/1/215 7/1/215 1/1/215 13/1/215 16/1/215 19/1/215 22/1/215 25/1/215 28/1/215 31/1/215 3/2/215 6/2/215 9/2/215 12/2/215 15/2/215 18/2/215 21/2/215 24/2/215 27/2/215 2/3/215 5/3/215 8/3/215 11/3/215 14/3/215 17/3/215 2/3/215 23/3/215 26/3/215 29/3/215 January February March Q1-215 Figure 2: Distribution New Malicious Files Q1-215 In figure 2, just over 47, new and unique malicious files were collected and processed on January 29 th. The second best day for collecting malware, with 395, samples, was on January 24 th Processing Malware Working with malware is what we love to do. More than 22, new malicious files arrive at our automated malware collecting machines every day. All samples were renamed according to their hash calculation. We then check to see if that particular piece of malware has already been processed. Page 9

11 Storing Only The New Malicious Files In GBs January February March October November December January February March Q1-214 Q4-214 Q Figure 3: Storing New Malicious Files Q1-215 Figure 3 shows the total amount of disk space needed to store all the new malicious files. For the first quarter of 215, 13 Terabyte was needed, which is a 12 percent increase compared with the last quarter of Detecting Malware At RedSocks Malware Labs we use an in-house classification system for grouping malware. We have classified over 3 types for which we have created detailed statistics. Once multiple antivirus scanners (in paranoid mode) have performed their on-demand scan, we know which malware was detected and, perhaps more importantly, which was not. While in the first quarter of 215 the total amount of new malicious files was slightly less than last quarter of 214 (1.77 percent), the average detection rates of the anti-virus engines dropped dramatically. Page 1

12 Detection by Anti-Virus Engines 1% 9% 8% 7% 6% 5% 4% 3% 2% 1% % January February March October November December January February March Q1-214 Q4-214 Q Figure 4: Detection by Anti-Virus Engines In the last quarter of 214, the average detection by anti-virus was 87 percent. For the first quarter of this year, the average detection was only 42 percent. Figure 5 shows the percentage detected per month in green. We are working closely with the anti-virus industry to find the cause of the low detection rates. 1% 9% 8% 7% 6% 5% 4% 3% 2% 1% % Anti-Virus Detection Percentages Q /1/215 4/1/215 7/1/215 1/1/215 13/1/215 16/1/215 19/1/215 22/1/215 25/1/215 28/1/215 31/1/215 3/2/215 6/2/215 9/2/215 12/2/215 15/2/215 18/2/215 21/2/215 24/2/215 27/2/215 2/3/215 5/3/215 8/3/215 11/3/215 14/3/215 17/3/215 2/3/215 23/3/215 26/3/215 29/3/215 January February March Q1-215 Figure 5: Anti-Virus Detection Percentage Q1-215 Page 11

13 3.4. Classifying Malware We categorise malware according to its primary feature. In the first quarter, malware was grouped as follows: Malware Categories Backdoors Exploits Rootkits Trojans Worms Others Backdoors ADODB (D)DoS Trojans -Worms Adware Bot-Trojans HTML Banking Trojans Generic Worms (D)DoS Tools Java Batch Trojans IM-Worms AV Tools JS FakeAV IRC-Worms Constructors Linux GameThief Trojans Net-Worms DOS based MSExcel Generic Trojans Net-Worms Encrypted Malware MSPPoint IRC Trojans P2P-Worms Flooders MSWord Java Trojan Packed Worms Fraud Tools OSX LNK Trojans Script Worms Generic Malware PDF Packed Trojans Hack Tools Script Password Stealing Tr. Macro based SWF Proxy Trojans Malware Heuristic Win32 Ransom Trojans Monitors Win64 Rogue Trojans Nukers Script Trojans SMS Trojans Spy Trojans Trojan Clickers Trojan Dialers Trojan Downloaders Trojan Droppers Trojan Flooders Trojan Mailfinder Trojan Notifiers Trojan RATs WinREG Trojans Porn-Dialers Porn-Downloaders Porn-Tools PSW-Tools PUPs RemoteAdmin Riskware Spammers Spoofers SpyTools Spyware Suspicious Viruses Table 1: Malware Categories Q4 The Others category consists of malicious samples that do not fit in any of the six main categories. See appendix B: Classifying Malware for the numbers by day, category and month. Page 12

14 4. Trends Discovering malware-propagation-trends starts with an analysis of the raw data behind the collection and processing of malware. From October to December, RedSocks Malware Research Labs identified the following trends by malware category Backdoors In the first quarter of 215, over 146. unique files were identified either as have been infected with a backdoor, or as having bot functions, in this first quarter of 215. Files Identified as Backdoor January February March October November December January February March Q1-214 Q4-214 Q Figure 6: Files Identified as Backdoor Q1-215 In figure 6, we see that the amount of new files identified as backdoor have been dropping since November 214. In March the amount of identified backdoors is going up from 26.5 to 56. new samples. Page 13

15 Distribution of Backdoors Q /1/215 4/1/215 7/1/215 1/1/215 13/1/215 16/1/215 19/1/215 22/1/215 25/1/215 28/1/215 31/1/215 3/2/215 6/2/215 9/2/215 12/2/215 15/2/215 18/2/215 21/2/215 24/2/215 27/2/215 2/3/215 5/3/215 8/3/215 11/3/215 14/3/215 17/3/215 2/3/215 23/3/215 26/3/215 29/3/215 January February March Q1-215 Figure 7: Distribution of Backdoors Q1-215 All the spikes in figure 7 on 3 January, 2 February and 2 and 3 March are caused largely by variation of the Backdoor.Bot With over 68, unique samples, it was by far the most seen backdoor. Distribution of Backdoor.Bot Q /1/215 4/1/215 7/1/215 1/1/215 13/1/215 16/1/215 19/1/215 22/1/215 25/1/215 28/1/215 31/1/215 3/2/215 6/2/215 9/2/215 12/2/215 15/2/215 18/2/215 21/2/215 24/2/215 27/2/215 2/3/215 5/3/215 8/3/215 11/3/215 14/3/215 17/3/215 2/3/215 23/3/215 26/3/215 29/3/215 Figure 8: Distribution of Variations of Backdoor.Bot Q1-215 Page 14

16 4.2. Exploits Exploits are used to attack computer systems, especially one that takes advantage of a particular vulnerability. The amount of new malicious files identified as exploit dropped dramatically in the first quarter of 215, when compared with the last quarter of 214. Files Identified as Exploit January February March October November December January February March Q1-214 Q4-214 Q Figure 9: Files Identified as Exploits Q1-215 In quarter four of 214, a total of 11,255 unique files were identified as exploit. In the first quarter of 215 only 7,594 files were identified as exploit Distribution of Exploits Q /1/215 4/1/215 7/1/215 1/1/215 13/1/215 16/1/215 19/1/215 22/1/215 25/1/215 28/1/215 31/1/215 3/2/215 6/2/215 9/2/215 12/2/215 15/2/215 18/2/215 21/2/215 24/2/215 27/2/215 2/3/215 5/3/215 8/3/215 11/3/215 14/3/215 17/3/215 2/3/215 23/3/215 26/3/215 29/3/215 January February March Q1-215 Figure 1: Distribution of Exploits Q1-215 In figure 1, we can see two spikes one on January 3 rd (1,549) and one on February 2 th (1,245). Both are caused by exploit CVE C. Page 15

17 Distribution of CVE C Q /1/215 4/1/215 7/1/215 11/1/215 17/1/215 23/1/215 26/1/215 28/1/215 3/1/215 7/2/215 1/2/215 15/2/215 18/2/215 2/2/215 22/2/215 24/2/215 27/2/215 1/3/215 1/3/215 12/3/215 16/3/215 19/3/215 25/3/215 31/3/215 Figure 11: Distribution of CVE C Q1-215 Like in the last quarter, variations of the Exploit CVE C are still very popular among cyber criminals. This exploit identifies malicious PDF files downloaded by the Blackhole exploitkit that takes advantage of a known vulnerability in Adobe Reader. To prevent successful exploitation, install the latest updates available for Adobe Reader and/or remove any old and unnecessary installations. In total 5,39 unique new malicious files were identified as Exploit CVE C. Page 16

18 4.3. Rootkits A rootkit is a type of software designed to hide the fact that an operating system has been compromised. This can be done in various ways, such as replacing vital executables or by introducing a new kernel module. Rootkits allow malware to hide in plain sight. Rootkits themselves are not harmful; they are simply used to hide malware, bots and worms. To install a rootkit, an attacker must first gain sufficient access to the target operating system. This can be accomplished by using an exploit, by obtaining valid account credentials or through social engineering. Because rootkits are activated before the operating system boots up, they are very difficult to detect and therefore provide a powerful way for attackers to access and use the targeted computer without the owner being aware of it. Due to the way rootkits are used and installed, they are notoriously difficult to remove. Rootkits nowadays are usually not used to gain elevated access, but instead are used to mask malware payloads more effectively. Files Identified as Rootkit Q January February March October November December January February March Q1-214 Q4-214 Q Figure 12: Files Identified as Rootkit Q1-215 The total amount of identified rootkits in the first quarter was 8,442, a 7 percent increase when compared with last quarter. Page 17

19 Distribution of Rootkits Q /1/215 4/1/215 7/1/215 1/1/215 13/1/215 16/1/215 19/1/215 22/1/215 25/1/215 28/1/215 31/1/215 3/2/215 6/2/215 9/2/215 12/2/215 15/2/215 18/2/215 21/2/215 24/2/215 27/2/215 2/3/215 5/3/215 8/3/215 11/3/215 14/3/215 17/3/215 2/3/215 23/3/215 26/3/215 29/3/215 January February March Q1-215 Figure 13: Distribution of Rootkits Q1-215 A closer look at the identified rootkit samples shows that most samples contained, by far, a variation or small modification of the Rootkit.1562 family. Distribution of Rootkit.1562 Q /1/215 5/1/215 8/1/215 12/1/215 15/1/215 18/1/215 21/1/215 24/1/215 29/1/215 1/2/215 5/2/215 8/2/215 11/2/215 15/2/215 18/2/215 21/2/215 24/2/215 28/2/215 3/3/215 6/3/215 9/3/215 12/3/215 15/3/215 18/3/215 21/3/215 24/3/215 27/3/215 3/3/215 Figure 14: Distribution of Variations of Rootkit.1562 Q1-215 Page 18

20 4.4. Trojans With more than 4 million new unique samples in the first quarter of 215, trojans are by far the biggest category of malware. On average 45, new files per day were identified as trojan. Files Indentified as Trojan January February March October November December January February March Q1-214 Q4-214 Q Figure 15: Files Identified as Trojan Q1-215 In figure 16 we see the distribution of all 26 types of trojans during the first quarter of Distribution of Trojans Q /1/215 4/1/215 7/1/215 1/1/215 13/1/215 16/1/215 19/1/215 22/1/215 25/1/215 28/1/215 31/1/215 3/2/215 6/2/215 9/2/215 12/2/215 15/2/215 18/2/215 21/2/215 24/2/215 27/2/215 2/3/215 5/3/215 8/3/215 11/3/215 14/3/215 17/3/215 2/3/215 23/3/215 26/3/215 29/3/215 January February March Q1-215 Figure 16: Distribution of Trojans Q1-215 We want to share four of many trojan subcategories with you. These are the Trojan Downloaders and Droppers, plus the PSW and the Spy Trojan. Page 19

21 On average 9,959 unique samples were identified as Trojan Downloader in Q Of the 299, samples that were classified as Trojan Downloader, a stunning 256, were identified as belonging to 1 major malware family called Upatre. Trojan Droppers Q /1/215 5/1/215 9/1/215 13/1/215 17/1/215 21/1/215 25/1/215 29/1/215 2/2/215 6/2/215 1/2/215 14/2/215 18/2/215 22/2/215 26/2/215 2/3/215 6/3/215 1/3/215 14/3/215 18/3/215 22/3/215 26/3/215 3/3/215 Figure 17: Distribution of Trojan Downloaders Q1-215 Next are the Trojan Droppers. In the first quarter of 215, a total of 22, samples were identified as Trojan Dropper. On February 19 th 3,517 unique files were classified as Trojan Dropper, of which 2,243 belong to the Trojan.Dropper.VFN malware family. Trojan Downloader Upatre Q1-215 Upatre.O Upatre.N Upatre.L Upatre.K Upatre.J Upatre.I Upatre.H Upatre.G Upatre.F Upatre.E Upatre.D Upatre.C Figure 18: Upatre Trojan Download Family Q1-215 Page 2

22 This trojan was only seen on February 19 th. Trojan Droppers Q /1/215 5/1/215 9/1/215 13/1/215 17/1/215 21/1/215 25/1/215 29/1/215 2/2/215 6/2/215 1/2/215 14/2/215 18/2/215 22/2/215 26/2/215 2/3/215 6/3/215 1/3/215 14/3/215 18/3/215 22/3/215 26/3/215 3/3/215 Figure 19: Distribution of Trojan Droppers Q1-215 Password stealing trojans were identified in 14, unique samples. With 5,18 samples the Onlinegames.KEGA malware family was the most common password stealing trojan in Q PWS Trojans Q /1/215 5/1/215 9/1/215 13/1/215 17/1/215 21/1/215 25/1/215 29/1/215 2/2/215 6/2/215 1/2/215 14/2/215 18/2/215 22/2/215 26/2/215 2/3/215 6/3/215 1/3/215 14/3/215 18/3/215 22/3/215 26/3/215 3/3/215 Figure 2: Distribution of PWS Trojans Q1-215 Page 21

23 Looking at the Spy Trojans 4,583 unique samples were identified in the first quarter of 215. The spike on January 3 th was caused by Trojan.Spy.ZBot.CB and minor variations of it. The ZBot.CB Spy trojan was, with 29, samples, the most common Spy Trojan Spy Trojans Q /1/215 5/1/215 9/1/215 13/1/215 17/1/215 21/1/215 25/1/215 29/1/215 2/2/215 6/2/215 1/2/215 14/2/215 18/2/215 22/2/215 26/2/215 2/3/215 6/3/215 1/3/215 14/3/215 18/3/215 22/3/215 26/3/215 3/3/215 Figure 21: Distribution of Spy Trojans Q1-215 Page 22

24 4.5. Worms In roughly 351, new files we identified worm traces and functionalities. A tremendous drop compared to the 1.8 million of last quarter 214. Files Identified as Worm January February March October November December January February March Q1-214 Q4-214 Q Figure 22: Files Identified as Worm In figure 23 we see a dramatic increase for three days, starting on February 19 th. A closer look at the data of those days reveals that variations of the Palevo.DZ worm were widely distributed. Distribution of Worms Q /1/215 4/1/215 7/1/215 1/1/215 13/1/215 16/1/215 19/1/215 22/1/215 25/1/215 28/1/215 31/1/215 3/2/215 6/2/215 9/2/215 12/2/215 15/2/215 18/2/215 21/2/215 24/2/215 27/2/215 2/3/215 5/3/215 8/3/215 11/3/215 14/3/215 17/3/215 2/3/215 23/3/215 26/3/215 29/3/215 January February March Q1-215 Figure 23: Distribution of Worms Q1-215 The top 3 most identified Worm families for Q1-215 are: Palevo.DZ (56,1), Picsys.C (17,) and Revois.gen!A (7,89). Page 23

25 Bit Malware Malware designed to run on Windows 64-bit was identified in 7, new malicious samples in the first quarter - a massive decrease when compared with the 26, of the fourth quarter. Files Identified with 64-Bit Malware January February March October November December January February March Q1-214 Q4-214 Q Figure 24: Files Identified with 64-Bit Malware In January, 64-bit malware was only identified on the first day. In February 21, files were categorised as 64-bit malware. The amount of 64-bit malware doubled up in March to 47, Distribution of 64-Bit Malware Q /1/215 2/2/215 4/2/215 6/2/215 8/2/215 1/2/215 12/2/215 14/2/215 16/2/215 18/2/215 2/2/215 22/2/215 24/2/215 26/2/215 28/2/215 2/3/215 4/3/215 6/3/215 8/3/215 1/3/215 12/3/215 14/3/215 16/3/215 18/3/215 2/3/215 22/3/215 24/3/215 26/3/215 28/3/215 3/3/215 January February March Q1-215 Figure 25: Distribution of 64-Bit Malware Q1-215 Expiro designed to infect 32-bit and 64-bit files aims to maximise profit and infects executable files on local, removable and network drives. As for the payload, this malware installs extensions for the Google Chrome and Mozilla Firefox browsers. The malware also Page 24

26 steals stored certificates and passwords from Internet Explorer, Microsoft Outlook and from the FTP client FileZilla. Browser extensions are used to redirect the user to a malicious URL, as well as to hijack confidential information, such as account credentials or online banking information. The virus disables some services on the compromised computer, including Windows Defender and Windows Security Center. It can also terminate processes. 64-Bit Malware Families Q1-215 Winnti.A Expiro.Z Expiro.R Expiro.Gen Expiro.Gen Expiro.G 4 Expiro.A 9.86 Dridex.D Apolmy.B Abul.A Figure 26: 64-Bit Malware Families Q1-215 Page 25

27 4.7. Others After the backdoors, exploits, rootkits, trojans, worms, and the 64-bit malware, we are still left with 2.8 million identified malicious files. This is 34 percent of the total of this quarter. Files Identified as Other Malware January February March October November December January February March Q1-214 Q4-214 Q Figure 27: Files Identified as Other Malware In figure 28, a clear spike is visible on February 19 th. On this day 119,923 unique new files were identified as containing other malware Distribution of Other Malware Q /1/215 4/1/215 7/1/215 1/1/215 13/1/215 16/1/215 19/1/215 22/1/215 25/1/215 28/1/215 31/1/215 3/2/215 6/2/215 9/2/215 12/2/215 15/2/215 18/2/215 21/2/215 24/2/215 27/2/215 2/3/215 5/3/215 8/3/215 11/3/215 14/3/215 17/3/215 2/3/215 23/3/215 26/3/215 29/3/215 January February March Q1-215 Figure 28: Distribution of Other Malware Q1-215 Page 26

28 The following three malware families were responsible for the spike: Generic.Malware.SN!.28E731D (3,), Generic.Malware.SN!.B38C1DE (29,), and Win32.Elkern.B (22,). Page 27

29 5. Geolocation A total of 17,325 active C&C servers were found and added to our blacklist in the first quarter of this year (3,738 in January, 3,484 February, and 1,13 in March). Figure 29 represents only the top 1 hosting countries Sum of the Top 1 C&C Hosting Countries January February March October November December January February March Q1-214 Q4-214 Q Figure 29: Sum of the Top 1 C&C Hosting Countries In figure 3, we see a closer look at the top C&C-hosting countries in this first quarter of 215. Top 1 C&C Hosting Countries Q January February March Q1-215 China France Germany Korea Republic Of Netherlands Pakistan Russian Federation Sweden Turkey Ukraine United Kingdom United States Figure 3: Top 1 C&C Hosting Countries Q1-215 Page 28

30 In the first quarter the United States still led the pack, followed by the Russian Federation and China: Top 1 Countries Hosting C&C January February March United States 77 United States 77 United States 2137 Russian Federation 473 Russian Federation 56 China 1127 Germany 259 Germany 26 Russian Federation 77 United Kingdom 225 United Kingdom 216 Germany 555 Netherlands 191 Ukraine 21 United Kingdom 426 Ukraine 182 Netherlands 187 France 384 France 143 France 134 Netherlands 378 China 141 China 16 Ukraine 35 Pakistan 123 Korea Republic Of 96 Korea Republic Of 335 Korea Republic Of 96 Turkey 76 Sweden 287 Table 1: Top 1 Countries Hosting C&C Q1-215 The amount of C&C servers hosted in the United States increased by 32 percent in March compared with February. China could be found in 8 th place in January and February, and in March it shoots to 2 nd place, with an increase of 1,63 percent compared with February. The Netherlands, as a hosting country for C&C Servers, dropped from 5 th place in January t 6 th place in February and ending up 7 th in March. The amount of C&C servers hosted in The Netherlands grew by 22 percent in March compared with February. Not only did we see a global increase in C&C server in the March, we also added 43 new countries to our C&C blacklists. With 73 C&C servers, Jordan is the highest ranking of the newly added countries that did not have any active C&C servers in January or February. For a full list of hosting C&C countries, see appendix C. Page 29

31 6. Final Word In the first quarter of 215, with an average of 222, new files per day, the total number of unique new malicious files processed was 2 million, a decrease of 1.77 percent compared with the amount of new malicious files from the fourth quarter of 214. The overall detection by Anti-Virus software was dramatically low. Only 8 million malicious files or percent of the total, were identified by anti-virus engines. Category Total Q1-215 % of Total Identified +/- compared to Q4-214 Backdoors 146, % +.28 % Exploits 7,594.7 % +.1 % Rootkits 8, % +.7 % Trojans 4,6, % % 3 Worms 35, % % Others 2,764, % % 4 Table 2: Malware Categories Q1-215 vs. Q4-214 By grouping and classifying the identified malware, we detected a slight increase of popularity in 5 of the 6 main malware categories during the first quarter. These five categories were: backdoors, exploits, rootkits, trojans and others. The category worms decreased by 2.85 percent when compared with the quarter four 214. Largest Family Total Q1-215 Backdoor.Bot ,3 Exploit:W32/CVE C 5,39 Rootkit ,993 Gen:Variant.Sirefef ,856 Palevo.DZ 56,1 Within the top 1 countries hosting C&C servers, there was little change. But the amount of new C&C servers Win32.Expiro.Gen.3 1,117,874 has increased by 148 percent when compared with Table 3: Largest Malware Families Q1-215 the last quarter of 214. In January (3,738) and February (3,484) the amounts are comparable with Q In March there was a 268 percent increase in new C&C servers, bringing the total to 1,13. At the time of writing, we are still investigating what may be the cause of this global increase in C&C servers. The Netherlands dropped to the 8 th place in the first quarter. The amount of new C&C servers hosted in The Netherlands doubled in March to 378. For a complete list of C&C hosting countries, the amount of new C&C servers, and their percentages can be found in appendix C. Page 3