PinkStats
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 20 % (Normal) |
| Infected Computers: | 0 |
| First Seen: | June 26, 2013 |
| OS(es) Affected: | Windows |
In recent years, PC security researchers have uncovered numerous malware attacks coming out of China. Many malware analysts suspect that these kinds of attacks are state sponsored due to the sophistication and backing that they receive. At the least, these attacks may be perpetrated by a small band of criminals with many resources that may then be selling the information to companies or government institutions in China. There are several reasons why these attacks may be state sponsored; they use malware that is highly sophisticated, demonstrate the band of criminals has significant resources and often target Tibet activists or similar groups that are opposed to the Chinese government in some way. PinkStats is one of these sophisticated malware attacks that originated in China. Attacks involving PinkStats have been occurring at least in the last four years all around the world.
The PinkStats Attacks and Their Possible Source
PinkStats has been responsible for numerous high profile attacks. PinkStats is disguised as an application for Web analytics. This fact is the reason for why PinkStats has 'stats' in its name. It has been PinkStats because of its distinctive pink user interface. Once PinkStats has been installed on a victim's computer, PinkStats connects to a remote Command and Control server. Criminals can then use PinkStats to compromise the infected computer, spying on its contents and even controlling it from a remote location. Most of the time, PinkStats is used to install other malware on the infected computer.
PinkStats uses a fake user interface (for its Web analytics component) written in Chinese. Large portions of PinkStats' code are also in Chinese. Since China has been at the center of numerous global malware attacks in recent years, it is fair to assume that PinkStats is in some way connected to the Chinese government. This is also due to the case of NetTraveler, a high profile attack that targeted important political targets with a very high value for the Chinese government. PinkStats has been used in malware attacks going as far back as 2009, although it is possible that PinkStats may have been used previously to that in attacks that have not been detected. The most recent attack involving PinkStats as used to compromise various university computers in South Korea.
