Bugbear.B Worm Targets the Banking Sector
Bugbear.A was the most Widespread Virus in 2002
Helsinki, Finland, June 5, 2003- F-Secure is warning the computer users of a worm known as Bugbear.B. This worm was first seen on Thusday morning, June 5th, 2003. It is a new variant of the Bugbear.A e-mail worm (also known as Tanatos) that was found on Monday, September 30, 2002. Bugbear.A was the most common and widespread virus in 2002.
The most alerting capacity of this worm is that it includes a large list of domains belonging mostly to banks. The worm checks if an infected computer is in one of these domains, and makes changes to the system in these computers.
“The list of bank domains that the worm has, includes banks from all over the world; Europe, US, Asia and Africa”, says Mikael Albrecht, Product Manager of F-Secure. “Bugbear.B changes system settings if activated in one of these banks. The purpose of these actions is still unknown. They may be part of a malicious scenario but we can’t confirm that yet”, he continues.
Bugbear.B is a very complex polymorphic virus that spreads through both email and network shares. The worm sends e-mails with various contents. It uses a known vulnerability to execute the attachment automatically when the e-mail is opened.
“This virus is tricky, it contains many different techniques. It has UPX compression, encryption with random keys, backdoors, key-logging, retro-functionality, aggressive mass-mailing and network worm capabilities.”, explains Mikael Albrecht. “The network worm capabilities may be dangerous to large organisations. It may cause very fast outbreaks if this virus manages to get inside the firewall”.
More information on the Bugbear.B virus is available online at http://www.f-secure.com/v-descs/bugbear_b.shtml .The page includes technical descriptions and images.
F-Secure Anti-Virus can detect, and stop the Bugbear.B worm. F-Secure Anti-Virus can be downloaded from http://www.f-secure.com
About F-Secure
F-Secure Corporation is the leading provider of centrally managed security solutions for the mobile enterprise. The company’s award-winning products include antivirus, file encryption and network security solutions for major platforms from desktops to servers and from laptops to handhelds. Founded in 1988, F-Secure has been listed on the Helsinki Exchanges since November 1999. The company is headquartered in Helsinki, Finland, with the North Ameri-can headquarters in San Jose, California, as well as offices in Germany, Sweden, Japan and the United Kingdom and regional offices in the USA. F-Secure is supported by a network of value added resellers and distributors in over 90 countries around the globe. Through licens-ing and distribution agreements, the company’s security applications are available for the products of the leading handheld equipment manufacturers, such as Nokia and HP.