full-disclosure - Bagle worm status + more blocking information

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <400C41B0.9070403@egotistical.reprehensible.net>
From: ge at egotistical.reprehensible.net (Gadi Evron)
Subject: Bagle worm status + more blocking information

Although some AV firms web pages still call this a "not so serious" 
threat, the latest checks and cross-checks between vendors which are 
members of TH-Research (The Trojan Horses Research Mailing List) 
conclude that this is a serious Outbreak.

I believe new threat levels will be posted tomorrow morning, but it is
no longer a *possible* outbreak, it is BIG.

New information on the worm:

Status of the web pages this worm tries to connect to is still unclear.

Some vendors report it downloading a certain Trojan, but we see no 
information on that so far since the web pages status is still unclear, 
as mentioned.

Mcafee also reports it listening on port 6777.

The worm tries to connect to the following hacked box: 151.201.0.39.

Finally now all AV products "speak" of this worm.
Response times for detecting/cleaning/webpages updates were not so good.

As I mentioned earlier, Kaspersky and The Cleaner (MooSoft) were the 
noticeable exceptions.

FYI.

	Gadi Evron.

The Trojan Horses Research Mailing List - http://ecompute.org/th-list