1. /
  2. Security Response/
  3. W32.Beagle.B@mm

W32.Beagle.B@mm

Risk Level 2: Low

Discovered:
February 17, 2004
Updated:
February 13, 2007 12:17:35 PM
Also Known As:
W32.Alua@mm, Win32/Bagle.B.Worm [Computer A, Bagle.B [F-Secure], W32/Bagle.b@MM [McAfee], W32/Bagle.B@mm [Norman], WORM_BAGLE.B [Trend Mirco], W32/Bagle.B.worm [Panda], W32/Tanx-A [Sophos], I-Worm.Bagle.b [Kaspersky]
Type:
Worm
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

W32.Beagle.B@mm is a mass-mailing worm that opens a backdoor on TCP port 8866. The worm uses its own SMTP engine for email propagation. It can also send to the attacker the port on which the backdoor listens, as well as a randomized ID number.

The email has the following characteristics:

From: <spoofed>
Subject: ID <random characters>... thanks
Attachment: <random characters>.exe


Notes:
  • Beta definitions 27975, dated February 17, 2004, 5:20AM PT, or later will detect this threat.
  • Initial builds may detect this threat as W32.Alua@mm or W32.Aula@mm.






The following domains can be blocked to prevent the worm from submitting any information.
  • www.strato.de
  • www.47df.de
  • www.intern.games-ring.de
Translations of this Document:
Given the time needed to translate documents into other languages, the translated versions of this document may vary in content if the English document was updated with new information during the translation process. The English document always contains the most up-to-date information.

Available translations:
German
French
Italian
Portuguese
Spanish
Korean
Japanese
Simplified Chinese
Traditional Chinese

Antivirus Protection Dates

  • Initial Rapid Release version February 17, 2004
  • Latest Rapid Release version February 17, 2004
  • Initial Daily Certified version February 17, 2004
  • Latest Daily Certified version February 17, 2004
  • Initial Weekly Certified release date February 17, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 50 - 999
  • Number of Sites: More than 10
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Moderate

Damage

  • Damage Level: Medium

Distribution

  • Distribution Level: High
Writeup By: Fergal Ladley

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver