[Full-Disclosure] [Fwd: [TH-research] Modified Bagle]

From: Gadi Evron (ge_at_egotistical.reprehensible.net)
Date: 01/23/04

  • Next message: Gadi Evron: "AV products vulnerability [Fwd: [TH-research] Upx hack tool]" 
    To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
Date: Thu, 22 Jan 2004 18:28:56 -0800

    Hi, here's an heads-up from Daniel Otis Vigil on TH-Research (The Trojan
    Horses Research Mailing List) about a modified Bagle worm, a lot sooner
    than expected by most experts, but not too surprising.

    More information will be posted if it will be determined that this is a
    new outbreak situation.

    As always, this message is forwarded under the guidelines as they are
    specified in the TH-Research FAQ.

           Gadi Evron.

    The Trojan Horses Research Mailing List - http://ecompute.org/th-list

    From: "Daniel Otis-Vigil"
    To: TH-Research
    Subject: [TH-research] Modified Bagle
    Date: Thu, 22 Jan 2004 08:57:36 -0700

    Mail from "Daniel Otis-Vigil"

    Offset 0x118
    Old: 0000000000A0000000040000392701
    New: 2020000000A0000000040000BA5300

    Offset 0x230
    Old: A003
    New: 0010

    The modified sample will be on the exchange in a moment!

    So what was changed?

    Daniel Otis-Vigil
    MooSoft Development
    http://www.moosoft.com

    -
    TH-Research, the Trojan Horses Research mailing list.
    List home page: http://ecompute.org/th-list

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Gadi Evron: "AV products vulnerability [Fwd: [TH-research] Upx hack tool]"