Virus Bulletin - May 2012


Editor: Helen Martin

Technical Consultant: John Hawes

Technical Editor: Morton Swimmer

Consulting Editors: Ian Whalley, Nick FitzGerald, Richard Ford, Edward Wilding

2012-05-01


Comment

AV: Mind the gap

‘Has AV run its course and is it time to move on?’ Chad Loeven, Silicium Security

Chad Loeven - Silicium Security, USA

News

Flashback cash

Flashback botnet estimated to have generated $10,00 per day.

Helen Martin - Virus Bulletin, UK

Religion riskier than pornography

Symantec threat report suggests religious sites more likely to be infected than pornographic sites.

Helen Martin - Virus Bulletin, UK

Malware prevalence report

March 2012

The Virus Bulletin prevalence table is compiled monthly from virus reports received by Virus Bulletin; both directly, and from other companies who pass on their statistics.


Malware analyses

evilMule in kernel mode – an analysis of the network functionality of Sirefef

Win32/Sirefef (a.k.a. ZeroAccess) is one of the most prevalent threats in the wild today. Its main component is a kernel-mode driver, which implements a kernel-mode P2P file distribution system to deploy new malware components and upgrade existing ones. Chun Feng describes the design and implementation of this P2P file distribution system.

Chun Feng - Microsoft, Australia

Like a bat out of hell

A polymorphic batch file appears to be a holy grail to some virus writers, perhaps because of how insanely difficult it is to produce one. In spite (or perhaps because) of the challenges, one virus writer has managed it with BAT/Lymer. Peter Ferrie picks apart the details.

Peter Ferrie - Microsoft, USA

Technical features

Malware design strategies for circumventing detection and prevention controls – part one

Aditya Sood and Richard Enbody discuss some of the different techniques that are used by present-day malware to circumvent protection mechanisms.

Aditya K. Sood - Michigan State University, USA & Richard J. Enbody - Michigan State University, USA

Mobile banking vulnerability: Android repackaging threat

From a security point of view, Android's openness is one of its down sides. Researchers Seolwoo Joo and Changyeon Hwang show how a repackaged mobile banking app can be used to steal users' banking credentials.

Seolwoo Joo - AhnLab Inc., Republic of Korea & Changyeon Hwang - AhnLab Inc., Republic of Korea

Comparative review

VBSpam comparative review March 2012

Spam catch rates dropped significantly in the last VBSpam test, and they did not recover ground this time - and although all (complete) products qualified for VBSpam certification, none of the products in this month's test met the requirements for the higher level VBSpam+ award. Martijn Grooten has the details.

Martijn Grooten - Virus Bulletin, UK

Calendar

Anti-malware industry events

Must-attend events in the anti-malware industry - dates, locations and further details.


 

Latest articles:

Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

Aditya Sood & Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited to compromise the C&C panel in order to gather threat intelligence, and present a model of mobile AppInjects.

Cryptojacking on the fly: TeamTNT using NVIDIA drivers to mine cryptocurrency

TeamTNT is known for attacking insecure and vulnerable Kubernetes deployments in order to infiltrate organizations’ dedicated environments and transform them into attack launchpads. In this article Aditya Sood presents a new module introduced by…

Collector-stealer: a Russian origin credential and information extractor

Collector-stealer, a piece of malware of Russian origin, is heavily used on the Internet to exfiltrate sensitive data from end-user systems and store it in its C&C panels. In this article, researchers Aditya K Sood and Rohit Chaturvedi present a 360…

Fighting Fire with Fire

In 1989, Joe Wells encountered his first virus: Jerusalem. He disassembled the virus, and from that moment onward, was intrigued by the properties of these small pieces of self-replicating code. Joe Wells was an expert on computer viruses, was partly…

Run your malicious VBA macros anywhere!

Kurt Natvig wanted to understand whether it’s possible to recompile VBA macros to another language, which could then easily be ‘run’ on any gateway, thus revealing a sample’s true nature in a safe manner. In this article he explains how he recompiled…

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.