View Single Post
Old 03-04-2004, 05:31 AM  
erehwon
Confirmed User
 
erehwon's Avatar
 
Industry Role:
Join Date: Nov 2003
Location: A secure undisclosed location...
Posts: 3,759
This version is Bagle.J

http://www.eweek.com/article2/0,1759,1542021,00.asp

[...]

Like its predecessors, this version relies heavily on social engineering to entice recipients into opening the e-mail and infected attachment. The subject line of the worm-laden e-mail varies, but is typically one of the following:

E-mail account security warning
Notify about using the e-mail account
Warning about your e-mail account
Important notify about your e-mail account
Email account utilization warning
Notify about your e-mail account utilization
E-mail account disabling warning

The sending address is spoofed to make it appear as if the message is from someone in the recipient's domain. Some of the sending addresses include [email protected], [email protected] and [email protected], where "domain.com" is the recipient's own domain.

The name of the attachment carrying Bagle.J also varies, and the file itself can be an executable, a .PIF or a ZIP archive, according to NAI, based in Santa Clara, Calif.

[...]
__________________
Money NEVER $leep$...
erehwon is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote