Hiloti generic downloader is a Trojan that was first seen in December 2008 and has shown a dramatic increase in infection rates of PCs during June 2011. The malware is a generic malware downloader, meaning it typically downloads other malware such as Zeus and SpyEye.

Hiloti creates a malicious DLL in the Windows directory and hacks the Windows registry to maintain its presence on an infected machine across a normal boot cycle. IBM analysts suspect that a Hiloti-infecting campaign — quite likely a drive-by download infection — is now taking place, having started on June 20. Here is a typical infection graph from the U.K., which shows that Hiloti malware attacks are surging to two to three times previous levels of infection:

Is Hiloti Biased?

What’s interesting is that the infection does not appear to be affecting the U.S. and other international territories, suggesting that it is a carefully targeted attack on one or more U.K. banking portals. IBM Security’s research teams will continue to monitor the levels of infection of Hiloti. Users of the IBM Security Trusteer Rapport security solution are reportedly protected from the Hiloti downloader and its financial payload — even if other security defenses have not detected it.