|
|
|
|
| Virus Encyclopedia |  |
Riskware | |
Alerts | |
Analysis | |
News | |
Glossary | |
Weblog |
 |
| ||||||
|
| ||||||
|
| ||||||
| ||||||||||||
Home / Viruses / Virus Encyclopedia / Malware Descriptions / Network Worms / Email Worms
Email-Worm.Win32.Bagle.dxOther versions: .a, .aa, .ah, .ai, .al, .an, .ao, .as, .at, .au, .ax, .ay, .b, .bb, .bj, .bn, .bo, .c, .cc, .ch, .cl, .cy, .d, .da, .e, .eb, .ef, .eg, .ek, .f, .fb, .fj, .fm, .fy, .gm, .gt, .i, .j, .k, .l, .m, .n, .p, .q, .r, .s, .t, .y, .z
This worm spreads via the Internet as an attachment to infected messages. It also spreads via file-sharing networks. It sends itself to email addresses harvested from the victim machine. It includes a backdoor function. The worm itself is a Windows PE EXE file approximately 21KB in size, packed using FSG. The unpacked file is approximately 82KB in size. InstallationOnce launched, the worm copies itself to the Windows system directory as “winhost.exe”: %System%\winhost.exe It then registers this file in the system registry, ensuring that the worm will be launched each time Windows is rebooted on the victim machine: [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "winhost.exe" = "%System%\winhost.exe" Propagation via emailThe worm harvests email addresses from files with the following extensions: .adb .asp .cfg .dbx .dhtm .eml .htm .html .jsp .mbx .mdx .mht .mmf .msg .nch .ods .oft .php .sht .shtm .shtml .stm .tbb .txt .uin .wab .wsh .xls .xml It then sends itself to harvested addresses by establishing a direct connection to the recipient's SMTP server. It will not send itself to addresses which contain the following text strings: @avp. @foo @hotmail.com @iana @messagelab @microsoft @msn.com abuse admin anyone@ bsd bugs@ cafee certific contract@ feste free-av f-secur gold-certs@ google help@ icrosoft info@ kasp linux listserv local news nobody@ noone@ noreply ntivi panda pgp postmaster@ rating@ root@ samples shar sopho spam support unix update winrar winzip Infected messagesMessage subject (chosen at random from the list below):Changes.. Encrypted document Fax Message Forum notify Incoming message Notification Protected message Re: Re: Document Re: Hello Re: Hi Re: Incoming Message RE: Incoming Msg RE: Message Notify Re: Msg reply RE: Protected message RE: Text message Re: Thank you! Re: Thanks :) Re: Yahoo! Site changes Update Message body (chosen at random from the list below):Attach tells everything. Attached file tells everything. Check attached file for details. Check attached file. Here is the file. Message is in attach More info is in attach Pay attention at the attach. Please, have a look at the attached file. Please, read the document. Read the attach. See attach. See the attached file for details. Try this. Your document is attached. Your file is attached. SignatureIf the attachment to the infected message is in the form of an archive file, the message body will have a signature which is chosen at random from the list below: For security reasons attached file is password protected. The password is <image with password> For security purposes the attached file is password protected. Password -- <image with password> Note: Use password <image with password> to open archive. Attached file is protected with the password for security reasons. Password is <image with password> In order to read the attach you have to use the following password: <image with password> Archive password: <image with password> Password - <image with password> Password: <image with password> Attachment name (chosen at random from the list below):Details.exe Document.exe Info.exe Information.exe Message.exe MoreInfo.exe Readme.exe Sources.exe text_document.exe Updates.exe The attachment may contain a password protected zip archive. If this is the case, the password for the archive is included in the body of the message. Propagation via P2PThe worm creates copies of itself in all sub-folders which contain the worm “Shar” in their names. The copies are saved under names chosen from the list below: 12 year old Katia sucks and fucks me in lots of positions. (teen preteen anal cumshot sex young whore school lolita.avi <multiple spaces>.exe Adobe Photoshop 9 full.exe Ahead Nero 7.exe Doom3_nocd.exe HalfLife2_noCD.exe Kaspersky Antivirus 5.0 KAV 5.0 Lolita porn.avi <multiple spaces> .exe Matrix 3 Revolution English Subtitles.exe Microsoft Office 2003 Crack, Working!.exe Microsoft Office XP working Crack, Keygen.exe Microsoft Windows XP, WinXP Crack, working Keygen.exe Norton Antivirus, working Keygen.exe nude lolita.jpg <ìíîãî ïðîáåëîâ> .exe Opera 8 New!.exe Porno pics arhive, xxx.exe Porno Screensaver.scr Porno, sex, oral, anal cool, awesome!!.exe Serials.txt.exe WinAmp 5 Pro Keygen Crack Update.exe WinAmp 6 New!.exe Windown Longhorn Beta Leak.exe Windows Sourcecode update.doc.exe XXX hardcore images.exe Remote administrationThe worm opens TCP port 9035 and listens for commands from the remote malicious user. OtherThe worm contains a list of URLs which it will check periodically to see if files have been placed on these sites. If it finds such a file, it will download the file to the victim machine and launch it. The list of URLs is as follows: http://***hiphops.com http://***omy.ru/_old_img http://***yforum.ru http://64.***.44.10 http://64.12.***.12 http://68.**.54.122 http://b***g.org http://block***.net/img http://motiveth***.com/img http://nine-***-one.ca/images http://res***.com http://talen***.com/img http://tovar***.net http://www.***creations.com/img http://www.***dgoods.com/img http://www.ladyw***s.com http://zal***.net Bagle.dx will also terminate processes if the process names contain the following strings: AGENTSVR.EXE ANTI-TROJAN.EXE ANTIVIRUS.EXE ANTS.EXE APIMONITOR.EXE APLICA32.EXE APVXDWIN.EXE ATCON.EXE ATGUARD.EXE ATRO55EN.EXE ATUPDATER.EXE ATWATCH.EXE AUPDATE.EXE AUTODOWN.EXE AUTOTRACE.EXE AUTOUPDATE.EXE AVCONSOL.EXE AVGSERV9.EXE AVLTMAIN.EXE AVprotect9x.exe AVPUPD.EXE AVSYNMGR.EXE AVWUPD32.EXE AVXQUAR.EXE BD_PROFESSIONAL.EXE BIDEF.EXE BIDSERVER.EXE BIPCP.EXE BIPCPEVALSETUP.EXE BISP.EXE BLACKD.EXE BLACKICE.EXE BOOTWARN.EXE BORG2.EXE BS120.EXE ccApp.exe ccEvtMgr.exe CDP.EXE CFGWIZ.EXE CFIADMIN.EXE CFIAUDIT.EXE CFIAUDIT.EXE CFIAUDIT.EXE CFINET.EXE CFINET.EXE CFINET32.EXE CLEAN.EXE CLEANER.EXE CLEANER3.EXE CLEANPC.EXE CLEANPC.EXE CMGRDIAN.EXE CMGRDIAN.EXE CMON016.EXE CMON016.EXE CPD.EXE CPF9X206.EXE CPFNT206.EXE CWNB181.EXE CWNTDWMO.EXE DEFWATCH.EXE DEPUTY.EXE DPF.EXE DPFSETUP.EXE DRWATSON.EXE DRWEBUPW.EXE ENT.EXE ESCANH95.EXE ESCANHNT.EXE ESCANV95.EXE EXANTIVIRUS-CNET.EXE FAST.EXE FIREWALL.EXE FLOWPROTECTOR.EXE FP-WIN_TRIAL.EXE FRW.EXE FSAV.EXE FSAV530STBYB.EXE FSAV530WTBYB.EXE FSAV95.EXE GBMENU.EXE GBPOLL.EXE GUARD.EXE GUARDDOG.EXE HACKTRACERSETUP.EXE HTLOG.EXE HWPE.EXE IAMAPP.EXE IAMAPP.EXE IAMSERV.EXE ICLOAD95.EXE ICLOADNT.EXE ICMON.EXE ICSSUPPNT.EXE ICSUPP95.EXE ICSUPPNT.EXE IFW2000.EXE IPARMOR.EXE IRIS.EXE JAMMER.EXE KAVLITE40ENG.EXE KAVPERS40ENG.EXE KERIO-PF-213-EN-WIN.EXE KERIO-WRL-421-EN-WIN.EXE KERIO-WRP-421-EN-WIN.EXE KILLPROCESSSETUP161.EXE LDPRO.EXE LOCALNET.EXE LOCKDOWN.EXE LOCKDOWN2000.EXE LSETUP.EXE LUALL.EXE LUCOMSERVER.EXE LUINIT.EXE MCAGENT.EXE MCUPDATE.EXE MCUPDATE.EXE MFW2EN.EXE MFWENG3.02D30.EXE MGUI.EXE MINILOG.EXE MOOLIVE.EXE MRFLUX.EXE MSCONFIG.EXE MSINFO32.EXE MSSMMC32.EXE MU0311AD.EXE NAV80TRY.EXE navapsvc.exe NAVAPW32.EXE NAVDX.EXE NavShExt.dll NAVSTUB.EXE NAVW32.EXE NC2000.EXE NCINST4.EXE NDD32.EXE NEOMONITOR.EXE NETARMOR.EXE NETINFO.EXE NETMON.EXE NETSCANPRO.EXE NETSPYHUNTER-1.2.EXE NETSTAT.EXE NISSERV.EXE NMAIN.EXE NORTON_INTERNET_SECU_3.0_407.EXE NPF40_TW_98_NT_ME_2K.EXE NPFMESSENGER.EXE NPROTECT.EXE NPROTECT.EXE NSCHED32.EXE NTVDM.EXE NUPGRADE.EXE NVARCH16.EXE NWINST4.EXE NWTOOL16.EXE OSTRONET.EXE OUTPOST.EXE OUTPOSTINSTALL.EXE OUTPOSTPROINSTALL.EXE PADMIN.EXE PANIXK.EXE PAVPROXY.EXE PCC2002S902.EXE PCC2K_76_1436.EXE PCCIOMON.EXE PCDSETUP.EXE PCFWALLICON.EXE PCFWALLICON.EXE PCIP10117_0.EXE PDSETUP.EXE PERISCOPE.EXE PERSFW.EXE PF2.EXE PFWADMIN.EXE PINGSCAN.EXE PLATIN.EXE POPROXY.EXE POPSCAN.EXE PORTDETECTIVE.EXE PPINUPDT.EXE PPTBC.EXE PPVSTOP.EXE PROCEXPLORERV1.0.EXE PROPORT.EXE PROTECTX.EXE PSPF.EXE QCONSOLE.EXE QSERVER.EXE REGEDIT.EXE REGEDT32.EXE RESCUE.EXE RESCUE32.EXE RRGUARD.EXE RSHELL.EXE RULAUNCH.EXE SAFEWEB.EXE SAVSCAN.EXE SBSERV.EXE SETUP_FLOWPROTECTOR_US.EXE SETUPVAMEEVAL.EXE SFC.EXE SGSSFW32.EXE SHELLSPYINSTALL.EXE SymWSC.exe SYSEDIT.EXE TAUMON.EXE TAUSCAN.EXE TRACERT.EXE TRJSCAN.EXE TRJSETUP.EXE TROJANTRAP3.EXE UNDOBOOT.EXE UPDATE.EXE VBCMSERV.EXE VBCONS.EXE VBUST.EXE VIRUSMDPERSONALFIREWALL.EXE W32DSM89.EXE WATCHDOG.EXE WEBSCANX.EXE WHOSWATCHINGME.EXE WINRECON.EXE WNT.EXE WRADMIN.EXE WRCTRL.EXE WSBGATE.EXE WYVERNWORKSFIREWALL.EXE XPF202EN.EXE ZONALM2601.EXE ZONEALARM.EXE | ||||||||||||
Copyright © 1996 - 2010
Kaspersky Lab
Industry-leading Antivirus Software
All rights reserved
Email: webmaster@viruslist.com
