Internet threat level: 1
Home→Descriptions→Email-Worm.Win32.Bagle.p
Email-Worm.Win32.Bagle.p
| Detected | Mar 18 2004 12:26 GMT |
| Released | Mar 25 2010 20:37 GMT |
| Published | Mar 18 2004 12:26 GMT |
Technical Details
This worm spreads throughout the Internet via carrier email and file-sharing networks. The carrier email does not contain the worm itself, but a script Trojan which downloads the worm from the Internet. The worm is coded to infect executable files.
The worm itself is a PE EXE file of approximately 25KB, packed using UPX. The size of the unpacked file is approximately 65KB.
Infected messages have the following characteristics:
Sender's address (chosen at random from the following list):
management administration staff noreply support antivirus antispam
The worm uses the domain name of the recipient of the infected message as the sender's domain name.
Message header (chosen at random from the list below):
Account notify E-mail account security warning. Notify about using the e-mail account. Warning about your e-mail account. Important notify about your e-mail account. Email account utilization warning. E-mail technical support message. E-mail technical support warning. Email report Encrypted document Fax Message Received Important notify E-mail warning Notify from e-mail technical support. Notify about your e-mail account utilization. E-mail account disabling warning. Password: Pass - Password - Re: Msg reply Re: Hello Re: Yahoo! Re: Thank you! Re: Thanks :) RE: Text message Re: Document Incoming message Re: Incoming Message Re: Incoming Fax Hidden message Protected message RE: Protected message Forum notify Request response Site changes Re: Hi
The message itself contains a VBS script. When this script is executed by the user, it exploits a vulnerability in Microsoft Internet Explorer (described in Microsoft Security Bulletins MS03-032 and MS03-040) and downloads the executable worm file over the Internet from a number of infected sites.
Installation
Once launched, the worm copies itself and its components to the Windows system directory under the names
directs.exe directs.exeopenand registers directs.exe in the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] direct.exe=%System%\direct.exe
The worm searches the system registry for keys installed by other worms (i.e.Netsky)
9XHtProtect Antivirus HtProtect ICQ Net ICQNet My AV Special Firewall Service Tiny AV Zone Labs Client Ex serviceand deletes them.
Propagation
The worm searches disks for files with the following extensions:
adb asp cfg cgi dbx dhtm eml htm jsp mbx mdx mht mmf msg nch ods oft php pl sht shtm stm tbb txt uin wab wsh xls xmland then sends messages to all mail addresses found in these files. The worm uses its own SMTP server to send messages.
Propagation via P2P
The worm searches disks for folders which contain the word 'shar' and copies itself several times to all folders found, under the following names:
ACDSee 9.exe Adobe Photoshop 9 full.exe Ahead Nero 7.exe Matrix 3 Revolution English Subtitles.exe Microsoft Office 2003 Crack, Working!.exe Microsoft Office XP working Crack, Keygen.exe Microsoft Windows XP, WinXP Crack, working Keygen.exe Opera 8 New!.exe Porno Screensaver.scr Porno pics arhive, xxx.exe Porno, sex, oral, anal cool, awesome!!.exe Serials.txt.exe WinAmp 5 Pro Keygen Crack Update.exe WinAmp 6 New!.exe Windown Longhorn Beta Leak.exe Windows Sourcecode update.doc.exe XXX hardcore images.exe
Infecting files
The worm searches all accessible disks for files with the extension .exe. The worm should then infect files by writing its polymorphic code to the end of the file.
Remote administration
The worm opens port 2556 and tracks port activity. The worm's backdoor function enables the remote execution of commands and downloading of files on the victim machine.
Other
The worm attempts to terminate antivirus programs and firewalls by terminating the following processes in memory:
AGENTSVR.EXE ANTI-TROJAN.EXE ANTIVIRUS.EXE ANTS.EXE APIMONITOR.EXE APLICA32.EXE APVXDWIN.EXE ATCON.EXE ATGUARD.EXE ATRO55EN.EXE ATUPDATER.EXE ATWATCH.EXE Au.exe AUPDATE.EXE AUTODOWN.EXE AUTOTRACE.EXE AUTOUPDATE.EXE AVCONSOL.EXE AVGSERV9.EXE AVLTMAIN.EXE AVprotect9x.exe AVPUPD.EXE AVSYNMGR.EXE AVWUPD32.EXE AVXQUAR.EXE BD_PROFESSIONAL.EXE BIDEF.EXE BIDSERVER.EXE BIPCP.EXE BIPCPEVALSETUP.EXE BISP.EXE BLACKD.EXE BLACKICE.EXE BOOTWARN.EXE BORG2.EXE BS120.EXE CDP.EXE CFGWIZ.EXE CFIADMIN.EXE CFIAUDIT.EXE CFINET.EXE CFINET32.EXE CLEAN.EXE CLEANER.EXE CLEANER3.EXE CLEANPC.EXE CMGRDIAN.EXE CMON016.EXE CPD.EXE CPF9X206.EXE CPFNT206.EXE CV.EXE CWNB181.EXE CWNTDWMO.EXE D3dupdate.exe DEFWATCH.EXE DEPUTY.EXE DPF.EXE DPFSETUP.EXE DRWATSON.EXE DRWEBUPW.EXE ENT.EXE ESCANH95.EXE ESCANHNT.EXE ESCANV95.EXE EXANTIVIRUS-CNET.EXE FAST.EXE FIREWALL.EXE FLOWPROTECTOR.EXE FP-WIN_TRIAL.EXE FRW.EXE FSAV.EXE FSAV530STBYB.EXE FSAV530WTBYB.EXE FSAV95.EXE GBMENU.EXE GBPOLL.EXE GUARD.EXE HACKTRACERSETUP.EXE HTLOG.EXE HWPE.EXE IAMAPP.EXE IAMSERV.EXE ICLOAD95.EXE ICLOADNT.EXE ICMON.EXE ICSSUPPNT.EXE ICSUPP95.EXE ICSUPPNT.EXE IFW2000.EXE IPARMOR.EXE IRIS.EXE JAMMER.EXE KAVLITE40ENG.EXE KAVPERS40ENG.EXE KERIO-PF-213-EN-WIN.EXE KERIO-WRL-421-EN-WIN.EXE KERIO-WRP-421-EN-WIN.EXE KILLPROCESSSETUP161.EXE LDPRO.EXE LOCALNET.EXE LOCKDOWN.EXE LOCKDOWN2000.EXE LSETUP.EXE LUALL.EXE LUCOMSERVER.EXE LUINIT.EXE MCAGENT.EXE MCUPDATE.EXE MFW2EN.EXE MFWENG3.02D30.EXE MGUI.EXE MINILOG.EXE MOOLIVE.EXE MRFLUX.EXE MSCONFIG.EXE MSINFO32.EXE MSSMMC32.EXE MU0311AD.EXE NAV80TRY.EXE NAVAPW32.EXE NAVDX.EXE NAVSTUB.EXE NAVW32.EXE NC2000.EXE NCINST4.EXE NDD32.EXE NEOMONITOR.EXE NETARMOR.EXE NETINFO.EXE NETMON.EXE NETSCANPRO.EXE NETSPYHUNTER-1.2.EXE NETSTAT.EXE NISSERV.EXE NISUM.EXE |
NMAIN.EXE NORTON_INTERNET_SECU_3.0_407.EXE NPF40_TW_98_NT_ME_2K.EXE NPFMESSENGER.EXE NPROTECT.EXE NSCHED32.EXE NTVDM.EXE NUPGRADE.EXE NVARCH16.EXE NWINST4.EXE NWTOOL16.EXE OSTRONET.EXE OUTPOST.EXE OUTPOSTINSTALL.EXE OUTPOSTPROINSTALL.EXE PADMIN.EXE PANIXK.EXE PAVPROXY.EXE PCC2002S902.EXE PCC2K_76_1436.EXE PCCIOMON.EXE PCDSETUP.EXE PCFWALLICON.EXE PCIP10117_0.EXE PDSETUP.EXE PERISCOPE.EXE PERSFW.EXE PF2.EXE PFWADMIN.EXE PINGSCAN.EXE PLATIN.EXE POPROXY.EXE POPSCAN.EXE PORTDETECTIVE.EXE PPINUPDT.EXE PPTBC.EXE PPVSTOP.EXE PROCEXPLORERV1.0.EXE PROPORT.EXE PROTECTX.EXE PSPF.EXE PURGE.EXE PVIEW95.EXE QCONSOLE.EXE QSERVER.EXE RAV8WIN32ENG.EXE REGEDIT.EXE REGEDT32.EXE RESCUE.EXE RESCUE32.EXE RRGUARD.EXE RSHELL.EXE RTVSCN95.EXE RULAUNCH.EXE SAFEWEB.EXE SBSERV.EXE SD.EXE SETUP_FLOWPROTECTOR_US.EXE SETUPVAMEEVAL.EXE SFC.EXE SGSSFW32.EXE SH.EXE SHELLSPYINSTALL.EXE SHN.EXE SMC.EXE SOFI.EXE SPF.EXE SPHINX.EXE SPYXX.EXE SS3EDIT.EXE ST2.EXE SUPFTRL.EXE SUPPORTER5.EXE SYMPROXYSVC.EXE SYSEDIT.EXE TASKMON.EXE TAUMON.EXE TAUSCAN.EXE TC.EXE TCA.EXE TCM.EXE TDS2-98.EXE TDS2-NT.EXE TDS-3.EXE TFAK5.EXE TGBOB.EXE TITANIN.EXE TITANINXP.EXE TRACERT.EXE TRJSCAN.EXE TRJSETUP.EXE TROJANTRAP3.EXE UNDOBOOT.EXE UPDATE.EXE VBCMSERV.EXE VBCONS.EXE VBUST.EXE VBWIN9X.EXE VBWINNTW.EXE VCSETUP.EXE VFSETUP.EXE VIRUSMDPERSONALFIREWALL.EXE VNLAN300.EXE VNPC3000.EXE VPC42.EXE VPFW30S.EXE VPTRAY.EXE VSCENU6.02D30.EXE VSECOMR.EXE VSHWIN32.EXE VSISETUP.EXE VSMAIN.EXE VSMON.EXE VSSTAT.EXE VSWIN9XE.EXE VSWINNTSE.EXE VSWINPERSE.EXE W32DSM89.EXE W9X.EXE WATCHDOG.EXE WEBSCANX.EXE WGFE95.EXE WHOSWATCHINGME.EXE WINRECON.EXE WNT.EXE WRADMIN.EXE WRCTRL.EXE WSBGATE.EXE WYVERNWORKSFIREWALL.EXE XPF202EN.EXE ZAPRO.EXE ZAPSETUP3001.EXE ZATUTOR.EXE ZAUINST.EXE ZONALM2601.EXE ZONEALARM.EXE |
Email-Worms spread via email. The worm sends a copy of itself as an attachment to an email message or a link to its file on a network resource (e.g. a URL to an infected file on a compromised website or a hacker-owned website).
In the first case, the worm code activates when the infected attachment is opened (launched). In the second case, the code is activated when the link to the infected file is opened. In both case, the result is the same: the worm code is activated.
Email-Worms use a range of methods to send infected emails. The most common are:
- using a direct connection to a SMTP server using the email directory built into the worm’s code
- using MS Outlook services
- using Windows MAPI functions.
Email-Worms use a number of different sources to find email addresses to which infected emails will be sent:
- the address book in MS Outlook
- a WAB address database
- .txt files stored on the hard drive: the worm can identify which strings in text files are email addresses
- emails in the inbox (some Email-Worms even “reply” to emails found in the inbox)
Many Email-Worms use more than one of the sources listed above. There are also other sources of email addresses, such as address books associated with web-based email services.
Email-Worm.
- I-Worm.
Bagle. p (Kaspersky Lab) - Virus:
W32/Bagle. q (McAfee) - W32/Bagle-Q (Sophos)
- W32/Bagle.
N. worm (Panda) - W32/Bagle.
Q (FPROT) - Worm:
Win32/Bagle. O@mm. dr (MS(OneCare)) - Win32.
HLLM. Beagle. 49152 (DrWeb) - Win32/Bagle.
Q worm (Nod32) - Win32.
Bagle. Q (BitDef7) - Win32.
Bagle. Gen (VirusBuster) - Win32:
Bagler (AVAST) - Email-Worm.
Win32. Bagle (Ikarus) - I-Worm/Bagle.
Q (AVG) - W32/Bagle.
inf (AVIRA) - W32.
Beagle. O@mm (NAV) - W32/Bagle.
Q@mm (Norman) - Win32.
Bagle. C (Rising) - Email-Worm.
Win32. Bagle. p [AVP] (FSecure) - PE_BAGLE.
S (TrendMicro) - Win32.
Bagle. Q (VirusBusterBeta)
© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.