NEWS FROM THE LAB - Friday, October 22, 2004

On the differences between Buchon and Netsky Posted by Ero @ 15:56 GMT

As previously mentioned Netsky.AG (aka Baba) was renamed as W32/Buchon@mm .

Probably the worm was originally assumed to belong the Netsky family because of certain text in the messages it sends. A brief look at the code clearly shows that there is not much resemblance among both worms.

The following picture shows Netsky.AD (left) and Buchon (right). Needless to say there is no pattern to be seen.

netsky_ad-buchon (198k image)

As a demonstration of how variants among a family look, these are Mimail.A (left) and Mimail.B (right). The resemblance is quite apparent.

mimail_a_b (268k image)