PandaLabs: New Malware Creation Hits Record High Numbers in 2013

Malware creation hits record high, Newly detected Ransomware CryptoLocker, DNS poisoning attacks on the rise & Android the most malware-targeted mobile platform.

Panda Security’s anti-malware laboratory, has just published the results of its Quarterly Report for Q3 2013, drawn up by PandaLabs, the company's anti-malware laboratory. One of the main conclusions that can be drawn from this global study, is that malware creation has hit a new record high, with nearly 10 million new strains identified so far this year. One Fact is, that the number of new malware samples in circulation in just the first nine months of 2013 has already met the 2012 figure for the entire year. Trojan Horses remained the most common threat, accounting for most new threats and infections worldwide.

One of the most notable threats over the past months is CryptoLocker, a new ransomware sample which surfaced in late 2013. It hijacks users’ documents and demands a ransom for them.

Example of CryptoLocker Message

There was also a significant increase in the number of attacks, known as DNS Spoofing. Several large websites hosted in Malaysia fell victim to this type of attack, including the local websites of companies such as Google, Microsoft or even the well known Computer Security Company Kaspersky Labs.

Android continued to be the top target among all mobile platforms, despite some high-profile attacks on iOS, Apple’s operating system.

Cyber-War: NSA remains in the eye of the storm

As far as Cyber Spying is concerned, the United States (Thanks to Ed Snowden from here. GD) took the spotlight off China after revelations emerged about the clandestine PRISM Surveillance Program operated by the NSA (National Security Agency) to obtain user data from major U.S. Cyber Companies such as Microsoft, Google, Apple, Facebook, etc.

“Everything seems to indicate that there will be more upcoming revelations about other NSA surveillance programs to indiscriminately spy on users, companies and governments around the world,” said Luis Corrons, technical director of PandaLabs.

Q3 2013 malware statistics

Trojans once again topped the rankings, accounting for 76.85 % of all new threats identified by PandaLabs, followed by worms, viruses and adware/spyware.

Additionally, Trojans continued to be the weapon of choice for malware writers to infect users’ systems. 78% of all computer infections registered in the third quarter of 2013 were caused by Trojans, followed by viruses (6.63 %), adware/spyware (6.05 %) and worms (5.67 %).

Geographic distribution of malware infections

Latin America remained the most-affected area by malware. In any event, the ‘Top 10’ list of most infected countries includes nations from all over the world, with China at the top with nearly 60 % of all computers infected with Malware, followed by Turkey (46.58 %) and Peru (42.55 %).

At the other end of the chart, Europe continues to have the lowest infection rates. The least infected countries were Netherlands (19.19 %) (Although the highest Concentrate of Malware Lancers, the infamous RBN & others originate from Amsterdam and the U.K. GD), United Kingdom (20.35 %) and Germany (20.60 %). The only non-European country in the Top Ten was Australia, in ninth place with 26.67 %.

The complete quarterly reports are available @ Panda Labs Press Room

The Virus: DEADBABE.SC.Replicator (In Memory to Peter Szor)

DEADBABE is a Malicious Virus (Win32) whos first appearence was catched "in the Wild" 2007 in Denmark.

It stays resident in memory and infects all EXE files that are executed. The virus does not activate in any way. It  is named after it's "are-you-there" call: it calls INT 6Bh with hex value BABE and expects to find the return value DEAD. Deadbabe will reinfect already infected files. As a result your files can have dozens of infections and they will be several kilobytes larger after the reinfection(s). An Intersting Virus (1989) Article in connection to INT 6Bh called  "Saddam Virus" can be read here.

According to F-Secure its anti-virus products will disinfect DEADBABE, but because of a bug in the virus, the disinfected file(s) will sometimes be longer than the original. This extra area might also contain pieces of the virus, which could cause false alarms or Type I errors (F/P). If encountering problems like this, you should delete these files and reinstall, restore or (in case you do not need them anymore (except for OS-Files) simply delete them.

A Notable magic number from this Malware is: 0xDEADBABE ("Dead Babe") is used by IBM Jikes RVM as a sanity check of the stack of the primary thread.

Some other Variant of This Malware is: Deadbabe.494.B which Threat Level is kindly Low on the affected Platform MS-DOS. It carries out damaging actions on the affected computer. It does not spread automatically using its own means. This Variant 494.B was detected exactly on this day eleven years ago (13/11/2002).

Brief Description:

Deadbabe.494.B needs an attacking user's intervention in order to reach the affected System. The means of transmission used include, among others, floppy disks (Old days), CD-ROMs (DVDs), E-mail messages with attached files, Internet downloads, FTPs (File Transfer Protocol), IRC channels, peer-to-peer (P2P) file sharing networks and more. Deadbabe.494.B uses the following infection strategies:

- Once it has been run, the virus goes memory resident and stops functions belonging to the operating system (OS). Therefore, every time the operating system or an application tries to access any of these functions, the virus will activate and infect new files. The Malicious Code is written in the programming language Assembler x86-16 bit.

NOTE: If you think your PC is infected with this Virus visit Pandasecurity, take a download and follow the mentioned step by step instructions.

DEADBABE is also committed to HPS, a polymorphic Windows 95 virus which contains this sarcastic text:

"< Hantavirus Pulmonary Syndrome (HPS) Virus BioCoded by GriYo / 29A >"

Technical Details of HPS:

It stays active in memory and infects Win32 EXE files as they are accessed, encrypting its own code with variable polymorphic encryption layer.

HPS activates itself on Saturdays. If a non-compressed Windows bitmap (BMP) file has been opened, the virus horizontally flips the picture.

HPS patches the value DEADBABE (in hex) to the end of the bitmap header area to avoid flipping the same image again. Since non-compressed bitmap files are frequently used by Windows 95 and 98, this causes all kinds of weird effects - such as the start-up and power-down screen of Windows being "mirrorized" (See Image).

REFERENCEs

Responsible for the Technical Details of this Threat is Mikko Hypponen & Peter Szor, F-Secure, 1997

In Memory of Peter Szor
(by McAfee Labs)