Do the malware authors ever get bored?
Last year saw a major malware campaign when W32/Stration hit the scene. In September of 2006 the author of Stration started his campaign of writing multiple variants and releasing them on the same day. Some days they released more than 100 variants at a time.
Last week SophosLabs released protection for W32/Stration-NZ which prompted me to go back and review the history of Stration samples. Here is a graph of unique samples over time. It makes use of the last modified time stamp on the files. It shows that some files were written ahead of the main campaign being released. At the end of the major campaign SophosLabs knew of approximately 2,500 unique files.
6 months later we have received another 500 variants with a few trickling in each week.
Clearly the author of Stration is not bored. The main campaign may be over but the malady lingers on.
Posted on May 21st, 2007 by Stuart Taylor, Manager SophosLabs UKFiled under: General, Malware
Windows 7 security - A great leap forward or business as usual?
