New Beagle/Bagle variant?



So, I submitted the suspicious attachment I received to virustotal (scan@virustotal.com with SCAN in the subject and suspicious file as attachment.) What follows below is the report I received. It looks like some of the big names (Symantec, McAfee are not finding anything wrong with it at this point, with the hodge-podge of names it will take me a bit to investigate and see if the other vendors are tagging it as new.)



Anyway here was my reply from virustotal…

Virus Total
_______________________________________________

Scan results
File: Bennet.zip
Date: 11/23/2005 17:47:52 (CET)
—-
AntiVir 6.32.0.6/20051123 found [TR/Bagle.EC]
Avast 4.6.695.0/20051123 found [Win32:Beagle-FR]
AVG 718/20051123 found [I-Worm/Bagle]
Avira 6.32.0.6/20051123 found [TR/Bagle.ED]
BitDefender 7.2/20051123 found [Trojan.Downloader.Bagle.F]
CAT-QuickHeal 8.00/20051123 found [(Suspicious) - DNAScan]
ClamAV devel-20051108/20051123 found [Worm.Bagle.Gen-9]
DrWeb 4.33/20051123 found [Win32.HLLM.Beagle.9219]
eTrust-Iris 7.1.194.0/20051123 found nothing
eTrust-Vet 11.9.1.0/20051123 found nothing
Fortinet 2.48.0.0/20051123 found [suspicious]
F-Prot 3.16c/20051123 found [security risk named W32/Mitglieder.GH]
Ikarus 0.2.59.0/20051123 found nothing
Kaspersky 4.0.2.24/20051123 found [Trojan-Downloader.Win32.Bagle.f]
McAfee 4634/20051122 found nothing
NOD32v2 1.1299/20051123 found [Win32/Bagle.DR]
Norman 5.70.10/20051123 found [W32/Bagle.FR@mm]
Panda 8.02.00/20051123 found nothing
Sophos 3.99.0/20051123 found nothing
Symantec 8.0/20051122 found nothing
TheHacker 5.9.1.042/20051122 found nothing
VBA32 3.10.5/20051123 found [suspected of Email-Worm.Bagle.22]

It is worth mentioning that if you have banned .exe’s within zip files it should be banned anyway.

It looks as though this is part of a wave of new bagle’s today. I don’t see anything particularly innovative in it’s way of spreading, the email I got was on the catchall account of a domain I monitor. It was to and from non-existent usernames (abc123 was the sending & receiving username) and the subject was “Alice”, signed Anne with an attachment of Bennet.zip. Not much trickery like we’re seeing with the Sober variant’s “you have visited illegal websites” “please review the charges in the attached file” kind of social engineering.

On the Sober.X (or Sober.Y depending on the AV vendor) front… since this time Monday, one mailserver I monitor for a local small business has filtered ~280+ copies of the Sober.y (or sober.x) virus. (I’m including about 6 that were filtered as banned (exe in a zip) between 2 and 3:30PM Monday when clamav updated to recognize the new bug.) In that same span there have been 2-5 phishing emails, 3 or so bagels… and another couple of banned attachements (again, application within a zip file) that may be some of these new bagel variants before clamav had detection.

As always, if you’ve got a network email setup, you might consider installing server antivirus. (Clamav on a linux server has been VERY effective for me.) I keep a few mail connections unfiltered so if/when there’s an outbreak I can actually get a first hand look at the bugs/submit to online scanners, etc… but that’s just me. The big thing that’s impressed me with clamav is the speed of updates. Most days there’s at least one update, some there are 4-6 depending on conditions. Phishing emails are among those that are detected as well. On the main mail server at the house… I use Amavis-new which handles scanning, then passes off emails to spamassassin, and clamav as necessary. (It also can deal with other virus scanners if you want multiple scans of incoming messages.)

Incidents.org has some coverage now on this.

Related Posts

Blog Traffic Exchange Related Posts
  • Disinfecting a PC... part 2 Ok, the last post got a bit long with the hijackthis log, but I wanted to include the whole picture. I put a few comments in, but thought it might be useful to include the notes I took at the time. For starters I leave it unplugged from the network.......
  • Modern Computer Viruses are almost NEVER from whom they claim to be from This is one that I've probably talked about before, but it's worth rehashing because of a call I had this afternoon. A customer had been receiving phone calls and email messages from folks asking that he stop sending them a virus. Essentially all of the viruses were claiming to be......
  • Virustotal No, virustotal is not the name of the latest greatest bug circulating. It's the name of a website that gives you the opportunity to submit a suspicious file and let them scan with multiple virus engines. Then, they send an email telling what it is detected as (if at all)......
Blog Traffic Exchange Related Websites
  • Confirmed My 5.1% Zopa CD Two days I purchased a Zopa CD right after the Federal Reserve cut the fed funds rate 75 basis points.  I half expected Zopa to renege on the 5.1% that I signed up under, especially since Bank Rate not shows that a 5.1% 1 year CD is now the top yielding 1......
  • Stick Man Workout 20091123 Here's my new fav workout.  Hit the exercises one after another any work with a medium to high intensity and not only with you feel great, you will be in and out of the gym in no time (barring waiting for the equipment - something that I had to......
  • Golf Swing Instruction: The Fundamentals of Approach Shots? Golf swing instruction is the best way of understanding the fundamentals of approach shots. The golf swing instruction manuals help in knowing the kind of approach shot you should try, or the way in which you should hit the ball. Perhaps you want to swing like John Daly? If you......
en.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site