Malware Fighting

Luis Corrons

PandaLabs Technical Director

Infection SourcesInfection Sources

Malware Fighting

WebWeb

SpamSpam

Social NetworksSocial Networks

Infection Sources

Social NetworksSocial Networks

Infection Sources

SpamSpam

Infection Sources

WebWeb

Infection Sources

Infection Sources Malware server

• MPack

Infection Sources

• MPack

Tracking Mpack for 2 months (April & May Tracking Mpack for 2 months (April & May 2007):2007):

41 different servers with Mpack running41 different servers with Mpack running

366,717 web pages “iframed”366,717 web pages “iframed”

More than 1 million users infected (1,217,741)More than 1 million users infected (1,217,741)

Infection Sources

• IcePack

• LoginLogin

Infection Sources

Who is behind this?Who is behind this?

Infection Sources

Yesterday’s Bad GuysYesterday’s Bad Guys

Blaster.B Nestky / Sasser CIH 29-A

Jeffrey Lee Parson Sven Jaschan Chen Ing-Hau Benny

Infection Sources

Today’s Bad GuysToday’s Bad Guys

Jeremy JaynesAndrew SchwarmkoffJames Ancheta

Phishing SpamSpam

Infection Sources

A Real CaseA Real Case

Malware Fighting

The “Infected Team”The “Infected Team”

Malware Fighting

MPackMPack

Dream DownloaderDream Downloader

LimboLimbo

Total Investment: 1,500$Total Investment: 1,500$

Malware Fighting

Let’s do some maths…Let’s do some maths…China, Korea, Japan:China, Korea, Japan: $0.01 * 70,300 = $703$0.01 * 70,300 = $703Finland, Norway…:Finland, Norway…: $0.05 * 70,300 = $3,515$0.05 * 70,300 = $3,515UK, France…:UK, France…: $0.20 * 70,300 = $14,060$0.20 * 70,300 = $14,060USA, Canada:USA, Canada: $0.40 * 70,300 = $28,120$0.40 * 70,300 = $28,120

And the same numbers in 30 days…And the same numbers in 30 days…China, Korea, Japan:China, Korea, Japan: $0.01 * 70,300 * 30 = $21,090$0.01 * 70,300 * 30 = $21,090Finland, Norway…:Finland, Norway…: $0.05 * 70,300 * 30 = $105,450$0.05 * 70,300 * 30 = $105,450UK, France…:UK, France…: $0.20 * 70,300 * 30 = $421,800$0.20 * 70,300 * 30 = $421,800USA, Canada:USA, Canada: $0.40 * 70,300 * 30 = $843,600$0.40 * 70,300 * 30 = $843,600

Malware Fighting

Who’s paying the “Infected Team”? Who’s paying the “Infected Team”?

Rogue AntiSpywareRogue AntiSpyware

Malware Fighting

How’s the money being handled?How’s the money being handled?

Malware Fighting

The Business of Cybercrime

Malware Fighting

Underground Shopping CartUnderground Shopping Cart

Malware Fighting

– Stolen AccountsStolen Accounts• FTP accounts: FTP accounts:

– US$1 per account US$1 per account

• Icq numbers: Icq numbers: – From US$1 to US$10 (depending on the ICQ number)From US$1 to US$10 (depending on the ICQ number)

• RapidShare premium accounts: RapidShare premium accounts: – 1 month1 month - US$5- US$5– 3 months3 months - US$12- US$12– 6 months 6 months - US$18- US$18– 1 year1 year - US$28- US$28

• Online Shop accounts Online Shop accounts – (megashop.ru, bolero.ru, cup.ru, etc. ALL RUSSIAN): US$50 each(megashop.ru, bolero.ru, cup.ru, etc. ALL RUSSIAN): US$50 each

• 50MB of Limbo Trojan logs 50MB of Limbo Trojan logs – US$30 (contains email accounts, bank account numbers, credit card US$30 (contains email accounts, bank account numbers, credit card

numbers, etc. A percentage is guaranteed)numbers, etc. A percentage is guaranteed)

Malware Fighting

– Stolen AccountsStolen Accounts• Credit CardsCredit Cards

– VISA / MASTERCARDVISA / MASTERCARD» 1 - 10 cards1 - 10 cards US$2 (per card)US$2 (per card)

» 10 - 100 cards10 - 100 cards US$1.5 (per card) US$1.5 (per card)

– AMEXAMEX» 1 - 10 cards1 - 10 cards US$2.5 (per card)US$2.5 (per card)

» 10 - 100 cards10 - 100 cards US$2 (per card) US$2 (per card)

• Passports: Passports: – Black and white:Black and white: US$2US$2– Color:Color: US$5 US$5

Malware Fighting

Where to buy?Where to buy?

Malware Fighting

Malware figuresMalware figures

Malware Fighting

Malware evolutionMalware evolution

Malware Fighting

Source: PandaLabs

Malware evolution by typeMalware evolution by type

Malware Fighting

Source: PandaLabs

Malware Fighting

Source: PandaLabs

Q3 2008 new malware

Malware Fighting

Source: PandaLabs

Q3 2008 Infections

Thanks!Thanks!Luis Corrons

luis.corrons@pandasecurity.com

PandaLabs Blog:

http://www.pandalabs.com

Malware Fighting

Technology

Fighting malware and spam VB100 COMPARATIVE REVIEW ON … · 2012-05-02 · APRIL 2012 ISSN 1749-7027 Fighting malware and spam VB100 COMPARATIVE REVIEW ON WINDOWS XP PROFESSIONAL

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Trafﬁc Exchanges

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Windows Malware Firewall: Remove Windows Malware Firewall

NSC-JST workshop · Fighting Malware & Botnets – Introduction ... Automated dynamic malware Behavior Analysis ... summary based on Cuckoo Sandbox

Fighting malware and spam CONTENTS IN THIS ISSUE · FEBRUARY 2013 CONTENTS IN THIS ISSUE ISSN 1749-7027 Fighting malware and spam NEW INTEREST In 2009, Intel introduced a new set

Fighting Stealth Malware – Towards Verifiable OSes · Fighting Stealth Malware – Towards Verifiable OSes Joanna Rutkowska Advanced Malware Labs 14th DFN-CERT Security Workshop

Intrusion Detection and Malware Analysis - Malware collection

Fighting malware and spam - Virus Bulletin · Panda Security has revealed that results from its online malware-scanning tool Nanoscan indicate that computers it scanned in the UK

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Fighting malware and spam CONTENTS IN THIS ISSUE · undermined by the malware that we are all working to defeat. What I want to ponder right now is the effect of the advice we give

Android Malware Exposed-Evolution of Android Malware

Malware & Anti-Malware

FIGHTING TARGETED MALWARE IN THE MOBILE Megan Ruthven ... › docs › us-17 › wednesday › us-17-Ruthve… · FIGHTING TARGETED MALWARE IN THE MOBILE ECOSYSTEM Megan Ruthven Andrew

Fighting malware and spam CONTENTS IN THIS ISSUE · As time went by, I was put in charge of collection sharing. In other words, I decided which malware ﬁ les Avira would share with

Fighting malware and spam CONTENTS IN THIS ISSUECONTENTS IN THIS ISSUE ISSN 1749-7027 Fighting malware and spam 2 COMMENT SSL certiﬁ cate warnings – nuisance or value? 3 NEWS Researchers

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Metamorphic Malware 1 Metamorphic Malware Research

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware