Bugbear.B Worm Targets the Banking Sector
Posted on 06 June 2003.
Bugbear.A was the most Widespread Virus in 2002

Helsinki, Finland, June 5, 2003- F-Secure is warning the computer users of a worm known as Bugbear.B. This worm was first seen on Thusday morning, June 5th, 2003. It is a new variant of the Bugbear.A e-mail worm (also known as Tanatos) that was found on Monday, September 30, 2002. Bugbear.A was the most common and widespread virus in 2002.

The most alerting capacity of this worm is that it includes a large list of domains belonging mostly to banks. The worm checks if an infected computer is in one of these domains, and makes changes to the system in these computers.

"The list of bank domains that the worm has, includes banks from all over the world; Europe, US, Asia and Africa", says Mikael Albrecht, Product Manager of F-Secure. "Bugbear.B changes system settings if activated in one of these banks. The purpose of these actions is still unknown. They may be part of a malicious scenario but we can't confirm that yet", he continues.

Bugbear.B is a very complex polymorphic virus that spreads through both email and network shares. The worm sends e-mails with various contents. It uses a known vulnerability to execute the attachment automatically when the e-mail is opened.

"This virus is tricky, it contains many different techniques. It has UPX compression, encryption with random keys, backdoors, key-logging, retro-functionality, aggressive mass-mailing and network worm capabilities.", explains Mikael Albrecht. "The network worm capabilities may be dangerous to large organisations. It may cause very fast outbreaks if this virus manages to get inside the firewall".

More information on the Bugbear.B virus is available online at http://www.f-secure.com/v-descs/bugbear_b.shtml .The page includes technical descriptions and images.

F-Secure Anti-Virus can detect, and stop the Bugbear.B worm. F-Secure Anti-Virus can be downloaded from http://www.f-secure.com

About F-Secure

F-Secure Corporation is the leading provider of centrally managed security solutions for the mobile enterprise. The company's award-winning products include antivirus, file encryption and network security solutions for major platforms from desktops to servers and from laptops to handhelds. Founded in 1988, F-Secure has been listed on the Helsinki Exchanges since November 1999. The company is headquartered in Helsinki, Finland, with the North Ameri-can headquarters in San Jose, California, as well as offices in Germany, Sweden, Japan and the United Kingdom and regional offices in the USA. F-Secure is supported by a network of value added resellers and distributors in over 90 countries around the globe. Through licens-ing and distribution agreements, the company's security applications are available for the products of the leading handheld equipment manufacturers, such as Nokia and HP.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Feb 9th