While we often report on the number of infections we’re seeing for a threat and what our honeynets are catching, we haven’t often shared the numbers on the amount of malicious code we’re seeing via Symantec’s antispam solutions. With Trojan.Peacomm still very much on the prowl and repeatedly blasting spam in short bursts of five to ten minutes, we thought we’d share some of our statistics on the malware we see being spammed around the globe. All of the numbers below are from December 22, 2006 to January 22, 2007.
Figure 1. Top 10 malware caught by Symantec Brightmail AntiSpam
One of the things that leaps out from this pie chart is that Peacomm has already ran past the mass-mailing “happy new year” worm (W32.Mixor.Q@mm) despite getting a much later start in the period. The actual number of Peacomm spam is even higher because the majority of messages detected as Trojan.Packed.8 are a result of Peacomm spam as well. Trojan.Packed.8 was a heuristic detection that initially triggered on Peacomm when it was released, but due to the increase in Peacomm activity it was split out into its own detection to allow it to be tracked more easily.
In the above graph (Fig. 1), W32.Mixor.Q@mm comes second after Peacomm in the amount of email detected. Because it is a mass-mailer, Mixor.Q is generating this email directly, unlike Peacomm which is being spammed out. However, there is a link between the two malware. While the first sample of Mixor.Q did not contain Peacomm, it did contain a simple downloader executable. Later samples of Mixor.Q were slightly modified to embed Peacomm, with Mixor simply dropping the executable and running it. It is highly likely that there is a direct correlation between the number of Mixor infections and the later rise of Peacomm, considering that Mixor dropped Peacomm as a payload.
A logical assumption would be that Mixor sent out Peacomm itself, but upon close analysis of a number of Mixor samples, this is not the case. Mixor merely drops Peacomm; so, we believe Peacomm was manually spammed out and the likely chain of events is as follows:
1. Mixor is embedded with Peacomm
2. Mixor self-replicates and infects a large number of hosts
3. Mixor drops Peacomm onto the infected system
4. Peacomm downloads other .exe files including spam proxies, mail harvesters, and self-updaters
5. The spam proxies are used to send spam: “game1.exe” spams out text stocks, and “game0.exe” (copied as taskdir.exe) spams out image-based stocks
One thing to note is that to date we have not seen any Peacomm-infected hosts instructed to send out emails with Peacomm attached in order to propagate Peacomm; these infected hosts are only sending out spam.
Figure 2. Malware per day as caught by Symantec Brightmail AntiSpam
This chart displays the amount of malware caught by our antispam solutions on a daily basis. The first bump is again due to Mixor.Q, which used social-engineering to persuade victims to open up a nasty New Year’s e-greeting card, while the second and more pronounced spike is due to Peacomm hitting the scene. If you have a hard time reading the numbers (they may be a little small), the spike on 2007-1-19 for Peacomm nearly struck the 13 million spam messages mark!
The Peacomm spam is changing form and is now sending out image-based spam that continues to advertise penny stocks. (Fig. 3) The image spam is being sent out at a slightly slower rate, but is still continuous. There are also new spam samples with “romantic” subjects, but these are being easily caught by Symantec Brightmail AntiSpam traps.
Figure 3. Peacomm image-based spam
As for the malware samples, there continues to be new executables downloaded and run to send new image-based spam. New malware variants are still being detected; however, the rootkit in the latest samples is the same used in the previous version.
In regard to operating systems affected, both the non-rootkit sample and the rootkit sample fail to install on Vista with UAC turned on. If a user explicitly right-clicks on the malicious file and clicks "Run as Administrator", then the threat will install the wincom32 driver file and registry entries, but the threat will fail to actually run. However, the restriction in the code that prevented it from executing on Windows 2003 has now been removed.
Symantec Security Response will continue to monitor this threat closely and release any new information or protection updates as new findings come to light.