We just received a new possible BAGLE currently spreading around:
TMIRT Honeypot already received 15 incidents in 30 minutes.
Initial Sample from TMIRT Honeypot received on: November 23, 2005 09:56 PM +0800 GMT.
MessageLabs already reported 1389 copies in 10 minutes.
Initial report received on: 5:55 AM.
Major AV Detections:
TMIRT Honeypot already received 15 incidents in 30 minutes.
Initial Sample from TMIRT Honeypot received on: November 23, 2005 09:56 PM +0800 GMT.
MessageLabs already reported 1389 copies in 10 minutes.
Initial report received on: 5:55 AM.
Major AV Detections:
- FileName : 1.zip/1.exe_
- TrendMicro : NO_VIRUS
- MailTrap : PAK_Generic.001
- Symantec : NO_VIRUS
- Kaspersky : NO_VIRUS
- McAfee : NO_VIRUS
- Sophos : NO_VIRUS
- Panda : NO_VIRUS
- Alwil : NO_VIRUS
- GeCAD (RAV): NO_VIRUS
- CAI : NO_VIRUS
- CAV : NO_VIRUS
- Ikarus : NO_VIRUS
- Ad-Aware : NO_VIRUS
- PestPatrol : NO_VIRUS
- CleanerPro : NO_VIRUS
- Size : 9,219Bytes
Major AV Descriptions: (Based from Main AV Sites)
- Trend: None
- Symantec: None
- Mcafee: None
- Kaspersky: None
- Sophos: None
- F-Secure: None
Possible Subjects used are:
- Ales
- Alyce
- Androwe
- Ann
- Anthonie
- Anthonye
- Bennet
- Bennett
- Daniel
- Delivery Status Notification (Failure)
- Edmund
- Edward
- Edwarde
- Elizabeth
- Ellen
- Emanuel
- Emanuell
- Frances
- Fraunces
- Grace
- Henrie
- Henrye
- Hughe
- Isabell
- Jane
- Jeames
- Johen
- John
- Judith
- Katherine
- Katheryne
- Margarett
- Margrett
- Marie
- Michael
- Mychaell
- Nathaniel
- Nicholas
- Peter
- Robert
- Roberte
- Roger
- Rose
- Samuell
- Sindony
- Sybyll
- Valentyne
- Wynefrede
- Wynnefreede
Do hold on for more updates in this page and in the Advisories section.
Update (Chachi, 23 November 2005 23:05:33)
This will be detected as TROJ_BAGLE.AH