|
|
|
|
| Virus Encyclopedia |  |
Riskware | |
Alerts | |
Analysis | |
News | |
Glossary | |
Weblog |
 |
| ||||||
|
| ||||||
|
| ||||||
| |||||||||||||||||||||
Home / Viruses / Virus Encyclopedia / Malware Descriptions / Network Worms / Email Worms
Email-Worm.Win32.Bagle.atOther versions: .a, .aa, .ah, .ai, .al, .an, .ao, .as, .au, .ax, .ay, .b, .bb, .bj, .bn, .bo, .c, .cc, .ch, .cl, .cy, .d, .da, .dx, .e, .eb, .ef, .eg, .ek, .f, .fb, .fj, .fm, .fy, .gm, .gt, .i, .j, .k, .l, .m, .n, .p, .q, .r, .s, .t, .y, .z
Bagle.at is a worm that spreads as an attachment to an infected email. The worm harvests addresses from the local address book and installs a proxy server. Bagle.at spreads either as Windows PE EXE file or a Windows Control Panel Applet (CPL) file, both about 20 KB in size. The worm is packed with PeX; the unpacked size is about 30 KB. InstallationWhen spreading as a Windows PE EXE file, Bagle.at creates copies of itself under one of the following names: C:\WINDOWS\SYSTEM32\wingo.exe C:\WINDOWS\SYSTEM32\wingo.exeopen C:\WINDOWS\SYSTEM32\wingo.exeopenopen And then registers this file in the System Registry autorun keys: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "wingo"="%system%\wingo.exe" If Bagle.at arrives as a Windows Control Panel Applet (CPL) file, then it is a dropper. If the file is executed it copies itself into the Windows folder under the name cjector.exe. This file extracts the worm's body from itself and drops it into the System Registry. Propagation via emailBagle.at scans the local disk for files with the following extensions:
And sends copies of itself to any email addresses it finds. Bagle.at connects to the recipients SMTP server to send emails. Bagle.at does not send copies to recipients where the address contains the following text strings:
Infected Message CharacteristicsSender address:Random Subject:Re: Re: Hello Re: Hi Re: Thank you! Re: Thanks :) Attachment name:Price Joke Attachment extensions:com cpl exe scr Propagation via P2PBagle.at creates copies of itself in all folders where the word 'shar' is in the name. The file names are chosen at random from the list below: ACDSee 9.exe Adobe Photoshop 9 full.exe Ahead Nero 7.exe Kaspersky Antivirus 5.0 KAV 5.0 Matrix 3 Revolution English Subtitles.exe Microsoft Office 2003 Crack, Working!.exe Microsoft Office XP working Crack, Keygen.exe Microsoft Windows XP, WinXP Crack, working Keygen.exe Opera 8 New!.exe Porno pics arhive, xxx.exe Porno Screensaver.scr Porno, sex, oral, anal cool, awesome!!.exe Serials.txt.exe WinAmp 5 Pro Keygen Crack Update.exe WinAmp 6 New!.exe Windown Longhorn Beta Leak.exe Windows Sourcecode update.doc.exe XXX hardcore images.exe Remote AdministrationBagle.at opens TCP port 81 and listens for further commands. For instance, the worm installs a proxy server that can be controlled via this port. OtherBagle.at attempts to connect to a number of compromised web sites to a file named g.jpg. The web sites were inaccessible at the time of writing. The worm is coded to stop functioning on April 25, 2006. Finally, Bagle.at attempts to block firewalls and antivirus solutions by stopping the following processes :
wingo.exe wingo.exeopen wingo.exeopenopen [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "wingo"="%system%\wingo.exe" | |||||||||||||||||||||
Copyright © 1996 - 2010
Kaspersky Lab
Industry-leading Antivirus Software
All rights reserved
Email: webmaster@viruslist.com
