Possible New Bagle: TROJ_BAGLE.AH

We just received a new possible BAGLE
currently spreading around:


TMIRT Honeypot already received 12 incidents in 30 minutes.

Initial Sample from TMIRT Honeypot received on: November 23, 2005
09:56 PM +0800 GMT.


MessageLabs already reported 1389 copies in 10 minutes.

Initial report received on: 5:55 AM.


Possible Subjects used are:

  • Ales
  • Alyce
  • Androwe
  • Ann
  • Anthonie
  • Anthonye
  • Bennet
  • Bennett
  • Daniel
  • Delivery Status Notification (Failure)
  • Edmund
  • Edward
  • Edwarde
  • Elizabeth
  • Ellen
  • Emanuel
  • Emanuell
  • Frances
  • Fraunces
  • Grace
  • Henrie
  • Henrye
  • Hughe
  • Isabell
  • Jane
  • Jeames
  • Johen
  • John
  • Judith
  • Katherine
  • Katheryne
  • Margarett
  • Margrett
  • Marie
  • Michael
  • Mychaell
  • Nathaniel
  • Nicholas
  • Peter
  • Robert
  • Roberte
  • Roger
  • Rose
  • Samuell
  • Sindony
  • Sybyll
  • Valentyne
  • Wynefrede
  • Wynnefreede



Do hold on for more updates in this page and in the Advisories
section.


Update (Chachi, 23 November 2005 23:05:33)
This will be detected as TROJ_BAGLE.AH


Update (Chachi, 24 November 2005 07:08:47)
After continuously monitoring the download
links from the trojan sample, we were able to acquire a sample of
the file it tries to download (z.php; 20KB). The extracted
executable file was confirmed to be another bagle variant (19,961
bytes [unzipped]).


This has been submitted to the service team for processing.