Russian Business Network study - bizeul.org

Version 1.0.1
RBN study – before and after
David Bizeul
Torpig analysis 2007-07-23 Torpig analysis 2007-10-25
It’s unpleasant to conclude that even 3 month after the reception of the file, this trojan has not been identified by most
antivirus editors. Few (only 3) identify it properly as Torpig/Sinowal.
Most major antivirus editors (Symantec, McAfee, Kaspersky or ClamAV) do not identify the threat. Those main editors
may represent at least 50% marketshare. Most people think they are protected against malware because they have
their miraculous antivirus but on this very issue, we can see people are still at risk and may encounter an identity theft at
any time.
The RBN Zoo
It’s clear that RBN is hosting many, many, many kinds of malware. I did not give an example for each, but many well
known malware have already been identified as being spread from RBN (Rustock, Haxdoor, Pinch…). Some antivirus
editors provide on their website a description of sample malicious code collected. That can be used to identify whether
RBN is implicated or no. An easy search on Exalead can also help to make up ones mind [ 11 ].
11
http://www.exalead.fr/search/resultsq=site%3a%28www.avira.com%29%20avira%20phishing%2081.95&nojs=1
9