virus logo Virus

W32/Bagle.GR@mm

description-logoAnalysis

  • Upon execution the malware prompts for the following messagebox.

  • The malware arrives as a password protected archive with the password indicated in the gif attachement.

  • Below is a screenshot of the spamed mail:


  • The malware resembles an icon of notepad file using what appears to be random filename and has an approximate file size of 185 Kb.

    • recommended-action-logoRecommended Action


      FortiGate systems:
    • check the main screen using the web interface to ensure the latest AV/NIDS database has been downloaded and installed -- if required, enable the " Allow Push Update" option

      • FortiClient systems:
    • Quarantine/Delete infected files detected and replace infected files with clean backup copies

    Telemetry logoTelemetry

    Detection Availability

    FortiClient
    Extreme
    FortiMail
    Extreme
    FortiSandbox
    Extreme
    FortiWeb
    Extreme
    Web Application Firewall
    Extreme
    FortiIsolator
    Extreme
    FortiDeceptor
    Extreme
    FortiEDR

    Version Updates

    Date Version Detail
    2019-08-27 71.17600 Sig Updated
    2019-07-19 70.09700 Sig Added
    ID 310201
    Released Dec 01, 2006
    Description
    Updated    		 Dec 01, 2006
    Aliases Email-Worm.Win32.Bagle.gr, W32/Bagle-QS
    Platform Profile Win32 file format / PE 32 bit