hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015Top malware discoveredThe top Windows malware discovered shows a slightly different view on previously unknownsamples. In our practice we have gotten used to a way of counting unique binary files as singleinstances, which works well in the case of Trojans—that is, malware that is unable to replicateitself. Our data shows that the most commonly encountered malware families are the ones thateither have the ability to replicate and create a functionally identical copy (worms) or an abilityto modify another executable to include its own functionality (parasitic viruses).Figure 8. Top malware samples discovered by ReversingLabs in 2014, by familyUnclassified (Other) 82%AgentRamnitSytroVirutZbotXpiroSalityLDMonOnline gamesLoring4%3%3%2%1%1%1%1%1%1%0% 10% 20% 30% 40% 50% 60% 70% 80% 90%Agent is a malware name thatis used as a name space for all malwaresamples that cannot be easily classified.By far the most commonly reported malware name is Agent. However, this name is not usedfor a single family, but rather as a name space for all malware samples that cannot be easilyclassified into any other known existing families. Again, this is directly related to the volumeof malicious files that need to be processed. The ability to fully analyze all malware, recognizewhat it is, and determine what it does is often beyond the means of many AV companies. Whena file is determined to be malicious, the pressure to detect large volumes of files means thatonce researchers know enough to add detection for the file, they move onto the next—onlydoing the minimum amount of security research necessary.Most of the other top 10 collected malware has the ability to replicate: Virut, Sality, andExpiro are polymorphic infectors that have been present for many years and may be usedfor information stealing, while Ramnit is a worm designed to steal information such as onlinebanking credentials. Onlinegames is a password stealing malware designed to steal thecredentials of online games. In fact, it seems that the majority of the top 10 malware is gearedtoward stealing data as opposed to immediately obtaining financial benefits, as is the case withfake anti-malware and ransomware samples.26