Signature Detail
Short Name |
WORM:BAGLE:Q-HTTP |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
WORM |
Release Date |
2004/04/21 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
WORM: Bagle.Q HTTP Traffic
This signature detects the Q through T variants of the Bagle SMTP virus. Bagle sends e-mails that contain an attachment with a malicious payload. When the attachment is viewed, the payload uses HTTP to load an external link, which is actually an executable program that infects the target host. The virus then sends a copy of itself to e-mail addresses found on the target's hard drive, using the target's e-mail address as the return address.
Extended Description
Bagle.Q is a worm that affects Microsoft Windows operating systems. It propagates through e-mail using a built-in SMTP engine. The worm opens a backdoor to allow remote attackers to control an affected machine.
References