Beagle-K...

Printable View

March 3rd, 2004, 07:17 PM
Negative

Beagle-K...

Just received a copy of Beagle-K, and I must say this is some good stuff... heh.

This is the e-mail I received:

Quote:

Dear user of Moneytronics.com,

Your e-mail account will be disabled because of improper using in next
three days, if you are still wishing to use it, please, resign your
account information.

Pay attention on attached file.

For security reasons attached file is password protected. The password is "10186".

Have a good day,
The Moneytronics.com team http://www.moneytronics.com

Sender was [email protected].
Note that I own moneytronics.com...

Here's the header info:

Quote:

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: (qmail 18067 invoked from network); 3 Mar 2004 17:38:48 -0000
Received: from eros.be.priorweb.net (213.193.229.18)
by ns2.priorweb.be with QMQP; 3 Mar 2004 17:38:48 -0000
Received: from [email protected] by eros by uid 1004 with qmail-scanner-1.20rc3
(clamscan: 0.60. Clear:RC:0:.
Processed in 1.31934 secs); 03 Mar 2004 17:38:48 -0000
Received: from unknown (HELO amanda-kv6pe0ib) (69.132.158.213)
by 0 with SMTP; 3 Mar 2004 17:38:47 -0000
Date: Wed, 03 Mar 2004 12:39:02 -0500
To: [email protected]
Subject: Warning about your e-mail account.
From: [email protected]
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------dndyiwntjxjbucdcsbyc"
X-Qmail-Scanner-Message-ID: <107833552763825642@eros>
X-Antivirus: avast! (VPS 0402-9, 03/03/2004), Inbound message
X-Antivirus-Status: Clean

The message came with a zipped password-protected exe-file (puotj.exe).
Note that Avast didn't pick it up (I have the latest March 3 database).

Here's the F-Secure info on Bagle/Beagle.K.
March 3rd, 2004, 08:38 PM
DjM

Geeezzz...... when are we going to get a break, my gateway server is just getting hammered right now. :eek:

Cheers:
March 3rd, 2004, 09:14 PM
Tiger Shark

Seems like a new variant or virus every few hours. I read somewhere that FSecure thinks that the virus writer is watching the AV company's web sites. When they publish a def he/she looks to see what they are keying on, alters the virus and rereleases it. Risky business if you ask me but it seems to be working. Like you DjM my servers are getting hammered with viruses too.... We got a netsky.c in before the def was avaialable that one "moron" clicked on.

Negative: we got a few of the j variant telling our users, (including my CEO), that I was cutting off their email..... Shoulda heard the whining, (especially the CEO...<LOL>), even though the attachment was "securitynotice.txt" telling them that the virus had been removed. I only emailed them all a week ago telling them how to check the attachment for a txt extension by doing a "save-as" so they could see the entire name of the attachment.....<sigh>
March 3rd, 2004, 09:26 PM
phishphreek

Don't know if its been said or not, but your AV didn't catch it because it couldn't scan it.

The files are coming through in a password protected encrypted attachment.

The AV scanners simply can't open them.
March 3rd, 2004, 09:29 PM
DjM

Quote:

Originally posted here by phishphreek80
Don't know if its been said or not, but your AV didn't catch it because it couldn't scan it.

The files are coming through in a password protected encrypted attachment.

The AV scanners simply can't open them.

Not the case here phish, I have my gateway configured so that if the attachment is a password protected encrypted file, it gets stripped off....no questions asked :p

Cheers:
March 3rd, 2004, 09:40 PM
cbss

Bagle VS NetSky

Quoting a Sans Ezine:

"[Editor's Note (Tan): Bagle and NetSky are fighting with each other. In
NetSky.F, researchers found the following text: "Skynet AntiVirus -
Bagle - you are a looser!!!!" This NetSky worm variant tries to remove
Bagle worm infection if it finds it on an infected computer. And in
Bagle.K, a message is embedded saying, "Hey, NetSky, ***** off you
b*tch!"] "

Is it China VS Europe or what?
March 3rd, 2004, 10:06 PM
lumpyporridge

Re: Bagle VS NetSky

Quote:

Originally posted here by cbss

Is it China VS Europe or what? [/B]

Nope spammers vs virus writer who doesn't like spammers. Strange days indeed i guess we cheer for the lesser of two evils?
March 3rd, 2004, 10:14 PM
phishphreek

Damn, I was just about to come back and say they must be having a virus war or stand off or something. I don't ever recall this many varients in so little time. Its getting freaking crazy!
March 3rd, 2004, 10:22 PM
DjM

Quote:

Originally posted here by phishphreek80
Damn, I was just about to come back and say they must be having a virus war or stand off or something. I don't ever recall this many varients in so little time. Its getting freaking crazy!

Mydoom just came out with a new one. W32.Mydoom.H@mm.

These guys/gals get into a pissing contest and we are the ones that suffer. :mad:

Cheers:
March 3rd, 2004, 11:06 PM
bongpilot

I just recieved this e-mail below. It was "supposedly" but it`s wasn`t sent from my ISP. The x`s are the names of my isp. attactched with a zip file. Clever.......

There is an e-mail circulating that comes from "[email protected]" or "[email protected]" with an attachment that contains a ZIP file. THIS IS A VIRUS! DO NOT open the attachment (usually attach.zip).

The body of the e-mail reads:

Dear user, the management of xxxxxxxsystem.com mailing system wants to let you know that,

Our antivirus software has detected a large amount of viruses outgoing from your e-mail account, you may use our free anti-virus tool to clean up your computer software.

Pay attention on attached file.

Attached file protected with the password for security reasons. Password is 23152.

Cheers,

The xxxxxxxxxx.com team.

Please notice the bad grammar and spacing issues in the body of the message;a good clue that this is a phony. This email did NOT come from our company, and the sender addresses do not exist. The addresses were "spoofed" (created and placed in there by the virus). All email address to "@xxxxxxxxx.com" or "@xxxxxxxxxxx.com" are scanned for viruses; this virus most likely came into our network from a foreign email address domain name and then propagated itself within the network.

As always, if you have questions, please call our Help Desk at xxx-xxx-xxxx. We are open from 6 am until 1am, 7 days a week.

xxxxxxx internet support
March 3rd, 2004, 11:40 PM
S3cur|ty4ng31

I know Tiger Shark is a snort user but I was wondering if anyone used the rules I had developed for the original Novarg virus? I tried to develop them to still function even under virus mutations.

What really should trigger on all these viruses though are the UPX rules I posted here. All these current viruses are still using UPX to hide the exe. And like Ive said before UPX is BS, its made specifically for trojans and virus writers to hide there exe's. While the UPX's rules do generate some false positives it has been 100% effective in triggering on true UPX viruses.
March 4th, 2004, 02:40 AM
Maestr0

Actually Angel, I gave your sigs to a one of our network engineers to try out. Called him today to see if he implemented them before the new beagle strain but he hasn't put them in place yet. I will let you know how they work when he gets them in. :)

-Maestr0

Nice work BTW, send me a PM if you have any other interesting stuff laying about.
March 4th, 2004, 08:37 PM
DjM

W32.Netsky.G@mm

Well it looks like the next shot in this little virus writers war has just been fired. A new variant of the Netsky family has been spotted.

W32.Netsky.G@mm

Cheers:
March 4th, 2004, 09:13 PM
phishphreek

An alphabet war?

Netsky is currently @ G... so 19 more varients to go?
MyDoom is currenty @ H... so 18 more varients to go?
Beagle is currently @ K... so 15 more varients to go?

Or, first to Z wins? Wonder what they "win"? What happens if they go past Z? Will they start all over again? W32.Netsky.AA.mm ? Anyone aware of any writer actaully creating that many varients? Am I asking too many questions? I think I need a vacation?
March 4th, 2004, 09:58 PM
DjM

Well from a "number of hits perspective" the Beagle family is winning at my gateway. Netsky is coming in second and Mydoom a distant third.

Cheers:
March 5th, 2004, 06:32 PM
DjM

W32.Netsky.H@mm

Another shot fired.

W32.Netsky.H@mm

Tag Beagle, your it.

Cheers:
March 5th, 2004, 08:04 PM
thehorse13

These shots you are seeing fired are nothing compared to what is coming down the line. Most of these viruses (according to my underground sources) are nothing more than fact finding viruses. Some are being respun by kiddies but there is a much higher purpose to this than just pissing off admins and security folks.

These viruses are all part of the plan to see how fast a virus/worm/trojan can spread across the internet. The idea is to get the time down below 15 minutes because this is the timeframe that virus coders have determined as the fastest amount of time that an enterprise can respond to an attack.

And for the grand finale, get ready for the polymorphic virus. Yes, this is a theory at the moment but some of my industry insiders have told me that two major AV companies have already begun development (and have beta code already) to combat this not too distant threat.

To sum it up, if you think you're in pain now, just wait about 6 months to a year.

Remember where you heard this first.

:)
March 5th, 2004, 08:10 PM
DjM

Thanks Hoss, that just made my day.......you got any good news for us. :rolleyes:
March 5th, 2004, 08:13 PM
thehorse13

Yes, I just saved a bunch of money on my car insurance...

:)
March 5th, 2004, 08:15 PM
DjM

Quote:

Originally posted here by thehorse13
Yes, I just saved a bunch of money on my car insurance...

:)

:rofl:
March 8th, 2004, 09:25 PM
phishphreek

Quote:

Originally posted here by thehorse13
These shots you are seeing fired are nothing compared to what is coming down the line. Most of these viruses (according to my underground sources) are nothing more than fact finding viruses. Some are being respun by kiddies but there is a much higher purpose to this than just pissing off admins and security folks.

These viruses are all part of the plan to see how fast a virus/worm/trojan can spread across the internet. The idea is to get the time down below 15 minutes because this is the timeframe that virus coders have determined as the fastest amount of time that an enterprise can respond to an attack.

And for the grand finale, get ready for the polymorphic virus. Yes, this is a theory at the moment but some of my industry insiders have told me that two major AV companies have already begun development (and have beta code already) to combat this not too distant threat.

To sum it up, if you think you're in pain now, just wait about 6 months to a year.

Remember where you heard this first.

:)

The digital pearl harbor?! :eek:

Well, just make sure that you have the quicklink to turn off the internet bookmarked.

First one to turn it off will be a hero!

http://www.turnofftheinternet.com/ (be sure to disable popup blockers)
March 8th, 2004, 10:02 PM
Tiger Shark

Phish:

Quote:

http://www.turnofftheinternet.com/

Gee.... thanks..... I had to restart my computer to get rid of that...... ;)

Hoss:

Quote:

Yes, I just saved a bunch of money on my car insurance...

I'm sure you are well aware of what peice of a Horse's anatomy best describes you..... :D
March 8th, 2004, 10:06 PM
phishphreek

Quote:

Originally posted here by Tiger Shark
Phish:

Gee.... thanks..... I had to restart my computer to get rid of that...... ;)

Nah. alt-f4 will close it. Or, ctrl alt del, and end task on that window. ;)
March 8th, 2004, 10:11 PM
Tiger Shark

That was a joke you wally...... Hence the ";)" after it.....<sigh>
March 8th, 2004, 10:16 PM
phishphreek

<homer> Doh! </homer>

Its that time of the day again... and to think I get to go sit in a lab and listen to a lecture for another 5 hrs... wanna go for me? You get to play with <Dr. Evil> "freakin laser beams!" </Dr. Evil> no sharks though...
March 8th, 2004, 10:19 PM
Tiger Shark

Phish: Sorry man..... While it sounds absolutely scintillating there is a cold one with my name scribbled all over it awaiting me at my local...... And I can't wait to see it.... Maybe some other time..... ;)