Virus:Worm/Bagle.DM
Date discovered:10/10/2005
Type:Worm
In the wild:No
Reported Infections:Low
Distribution Potential:Medium to high
Damage Potential:Low to medium
Static file:Yes
File size:21.232 Bytes
MD5 checksum:43e014ce23862dbc0efcbcccd05d6ac6
VDF version:6.32.0.67

 General Methods of propagation:
   • Email
   • Peer to Peer


Aliases:
   •  Symantec: w32.bEAGLE.cl@MM
   •  Kaspersky: eMAIL-wORM.wIN32.bAGLE.DX
   •  TrendMicro: worm_bagle.bt
   •  Bitdefender: wIN32.bAGLE.an@MM


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads files
   • Uses its own Email engine
   • Lowers security settings
   • Registry modification

 Files It copies itself to the following location:
   • %SYSDIR%\winhost.exe




It tries to download some files:

– The location is the following:
   • http://www.**********goods.com/img/3.exe
It is saved on the local hard drive under: %WINDIR%\test.exe Furthermore this file gets executed after it was fully downloaded. At the time of writing this file was not online for further investigation.

– The location is the following:
   • http://64.**********.145/ip.txt
It is saved on the local hard drive under: %WINDIR%\ip.txt At the time of writing this file was not online for further investigation.

 Registry The following registry key is added in order to run the process after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "winhost.exe"="%SYSDIR%\winhost.exe"



The following registry keys are added:

– [HKCU\Software\Timeout]
   • "uid"="%several random digits%"
   • "port"=dword:0000234b
   • "pid"=dword:%hex number%

 Email It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:


From:
The sender address is spoofed.


To:
– Email addresses found in specific files on the system.


Subject:
One of the following:
   • Changes..; Encrypted document; Fax Message; Forum notify; Incoming
      message; Notification; Protected message; Re:; Re: Document; Re:
      Hello; Re: Hi; Re: Incoming Message; RE: Incoming Msg; RE: Message
      Notify; Re: Msg reply; RE: Protected message; RE: Text message; Re:
      Thank you!; Re: Thanks :); Re: Yahoo!; Site changes; Update



Body:
The body of the email is one of the following:

   • Attach tells everything.
     Attached file tells everything.
     Check attached file for details.
     Check attached file.
     Here is the file.
     Message is in attach
     More info is in attach
     Pay attention at the attach.
     Please, have a look at the attached file.
     Please, read the document.
     Read the attach.
     See attach.
     See the attached file for details.
     Try this.
     Your document is attached.
     Your file is attached.


Continued by the following:

   • Archive password: %image containing the password%
     Attached file is protected with the password for security reasons. Password is %image containing the password%
     For security purposes the attached file is password protected. Password -- %image containing the password%
     For security reasons attached file is password protected. The password is %image containing the password%In order to read the attach you have to use the following password: %image containing the password%
     Note: Use password %image containing the password% to open archive.
     Password - %image containing the password%
     Password: %image containing the password%


Attachment:
The filename of the attachment is one of the following:
   • Information.exe
   • Details.exe
   • text_document.exe
   • Updates.exe
   • Readme.exe
   • Document.exe
   • Info.exe
   • Details.exe
   • MoreInfo.exe
   • Message.exe
   • Sources.exe

The attachment is a copy of the malware itself.

 Mailing Search addresses:
It searches the following files for email addresses:
   • .adb; .asp; .cfg; .dbx; .dhtm; .eml; .htm; .html; .jsp; .mbx; .mdx;
      .mht; .mmf; .msg; .nch; .ods; .oft; .php; .sht; .shtm; .shtml; .stm;
      .tbb; .txt; .uin; .wab; .wsh; .xls; .xml


Avoid addresses:
It does not send emails to addresses containing one of the following strings:
   • @avp.; @foo; @hotmail.com; @iana; @messagelab; @microsoft; @msn.com;
      abuse; admin; anyone@; bsd; bugs@; cafee; certific; contract@; feste;
      free-av; f-secur; gold-certs@; google; help@; icrosoft; info@; kasp;
      linux; listserv; local; news; nobody@; noone@; noreply; ntivi; panda;
      pgp; postmaster@; rating@; root@; samples; sopho; spam; support; unix;
      update; winrar; winzip

 P2P In order to infect other systems in the Peer to Peer network community the following action is performed:   It searches for directories that contain the following substring:
   • shar

   If successful, the following files are created:
   • 12 year old Katia ********** young whore school lolita.avi
       .exe; Adobe Photoshop 9 full.exe; Ahead Nero 7.exe; Doom3_nocd.exe;
      HalfLife2_noCD.exe; Kaspersky Antivirus 5.0; KAV 5.0; Lolita porn.avi
       .exe; Matrix 3 Revolution English
      Subtitles.exe; Microsoft Office 2003 Crack, Working!.exe; Microsoft
      Office XP working Crack, Keygen.exe; Microsoft Windows XP, WinXP
      Crack, working Keygen.exe; Norton Antivirus, working Keygen.exe; nude
      lolita.jpg .exe; Opera 8 New!.exe;
      Porno pics arhive, xxx.exe; Porno Screensaver.scr; Porno, **********cool, awesome!!.exe; Serials.txt.exe; WinAmp 5 Pro
      Keygen Crack Update.exe; WinAmp 6 New!.exe; Windown Longhorn Beta
      Leak.exe; Windows Sourcecode update.doc.exe; XXX hardcore images.exe

   These files are copies of the malware itself.

 Process termination List of processes that are terminated:
   • AGENTSVR.EXE; ANTI-TROJAN.EXE; ANTIVIRUS.EXE; ANTS.EXE;
      APIMONITOR.EXE; APLICA32.EXE; APVXDWIN.EXE; ATCON.EXE; ATGUARD.EXE;
      ATRO55EN.EXE; ATUPDATER.EXE; ATWATCH.EXE; AUPDATE.EXE; AUTODOWN.EXE;
      AUTOTRACE.EXE; AUTOUPDATE.EXE; AVCONSOL.EXE; AVGSERV9.EXE;
      AVLTMAIN.EXE; AVprotect9x.exe; AVPUPD.EXE; AVSYNMGR.EXE; AVWUPD32.EXE;
      AVXQUAR.EXE; BD_PROFESSIONAL.EXE; BIDEF.EXE; BIDSERVER.EXE; BIPCP.EXE;
      BIPCPEVALSETUP.EXE; BISP.EXE; BLACKD.EXE; BLACKICE.EXE; BOOTWARN.EXE;
      BORG2.EXE; BS120.EXE; ccApp.exe; ccEvtMgr.exe; CDP.EXE; CFGWIZ.EXE;
      CFIADMIN.EXE; CFIAUDIT.EXE; CFIAUDIT.EXE; CFIAUDIT.EXE; CFINET.EXE;
      CFINET.EXE; CFINET32.EXE; CLEAN.EXE; CLEANER.EXE; CLEANER3.EXE;
      CLEANPC.EXE; CLEANPC.EXE; CMGRDIAN.EXE; CMGRDIAN.EXE; CMON016.EXE;
      CMON016.EXE; CPD.EXE; CPF9X206.EXE; CPFNT206.EXE; CV.EXE; CWNB181.EXE;
      CWNTDWMO.EXE; DEFWATCH.EXE; DEPUTY.EXE; DPF.EXE; DPFSETUP.EXE;
      DRWATSON.EXE; DRWEBUPW.EXE; ENT.EXE; ESCANH95.EXE; ESCANHNT.EXE;
      ESCANV95.EXE; EXANTIVIRUS-CNET.EXE; FAST.EXE; FIREWALL.EXE;
      FLOWPROTECTOR.EXE; FP-WIN_TRIAL.EXE; FRW.EXE; FSAV.EXE;
      FSAV530STBYB.EXE; FSAV530WTBYB.EXE; FSAV95.EXE; GBMENU.EXE;
      GBPOLL.EXE; GUARD.EXE; GUARDDOG.EXE; HACKTRACERSETUP.EXE; HTLOG.EXE;
      HWPE.EXE; IAMAPP.EXE; IAMAPP.EXE; IAMSERV.EXE; ICLOAD95.EXE;
      ICLOADNT.EXE; ICMON.EXE; ICSSUPPNT.EXE; ICSUPP95.EXE; ICSUPPNT.EXE;
      IFW2000.EXE; IPARMOR.EXE; IRIS.EXE; JAMMER.EXE; KAVLITE40ENG.EXE;
      KAVPERS40ENG.EXE; KERIO-PF-213-EN-WIN.EXE; KERIO-WRL-421-EN-WIN.EXE;
      KERIO-WRP-421-EN-WIN.EXE; KILLPROCESSSETUP161.EXE; LDPRO.EXE;
      LOCALNET.EXE; LOCKDOWN.EXE; LOCKDOWN2000.EXE; LSETUP.EXE; LUALL.EXE;
      LUCOMSERVER.EXE; LUINIT.EXE; MCAGENT.EXE; MCUPDATE.EXE; MCUPDATE.EXE;
      MFW2EN.EXE; MFWENG3.02D30.EXE; MGUI.EXE; MINILOG.EXE; MOOLIVE.EXE;
      MRFLUX.EXE; MSCONFIG.EXE; MSINFO32.EXE; MSSMMC32.EXE; MU0311AD.EXE;
      NAV80TRY.EXE; navapsvc.exe; NAVAPW32.EXE; NAVDX.EXE; NavShExt.dll;
      NAVSTUB.EXE; NAVW32.EXE; NC2000.EXE; NCINST4.EXE; NDD32.EXE;
      NEOMONITOR.EXE; NETARMOR.EXE; NETINFO.EXE; NETMON.EXE; NETSCANPRO.EXE;
      NETSPYHUNTER-1.2.EXE; NETSTAT.EXE; NISSERV.EXE; NMAIN.EXE;
      NORTON_INTERNET_SECU_3.0_407.EXE; NPF40_TW_98_NT_ME_2K.EXE;
      NPFMESSENGER.EXE; NPROTECT.EXE; NPROTECT.EXE; NSCHED32.EXE; NTVDM.EXE;
      NUPGRADE.EXE; NVARCH16.EXE; NWINST4.EXE; NWTOOL16.EXE; OSTRONET.EXE;
      OUTPOST.EXE; OUTPOSTINSTALL.EXE; OUTPOSTPROINSTALL.EXE; PADMIN.EXE;
      PANIXK.EXE; PAVPROXY.EXE; PCC2002S902.EXE; PCC2K_76_1436.EXE;
      PCCIOMON.EXE; PCDSETUP.EXE; PCFWALLICON.EXE; PCFWALLICON.EXE;
      PCIP10117_0.EXE; PDSETUP.EXE; PERISCOPE.EXE; PERSFW.EXE; PF2.EXE;
      PFWADMIN.EXE; PINGSCAN.EXE; PLATIN.EXE; POPROXY.EXE; POPSCAN.EXE;
      PORTDETECTIVE.EXE; PPINUPDT.EXE; PPTBC.EXE; PPVSTOP.EXE;
      PROCEXPLORERV1.0.EXE; PROPORT.EXE; PROTECTX.EXE; PSPF.EXE;
      QCONSOLE.EXE; QSERVER.EXE; REGEDIT.EXE; REGEDT32.EXE; RESCUE.EXE;
      RESCUE32.EXE; RRGUARD.EXE; RSHELL.EXE; RULAUNCH.EXE; SAFEWEB.EXE;
      SAVSCAN.EXE; SBSERV.EXE; SD.EXE; SETUP_FLOWPROTECTOR_US.EXE;
      SETUPVAMEEVAL.EXE; SFC.EXE; SGSSFW32.EXE; SH.EXE; SHELLSPYINSTALL.EXE;
      SymWSC.exe; SYSEDIT.EXE; TAUMON.EXE; TAUSCAN.EXE; TRACERT.EXE;
      TRJSCAN.EXE; TRJSETUP.EXE; TROJANTRAP3.EXE; UNDOBOOT.EXE; UPDATE.EXE;
      VBCMSERV.EXE; VBCONS.EXE; VBUST.EXE; VIRUSMDPERSONALFIREWALL.EXE;
      W32DSM89.EXE; WATCHDOG.EXE; WEBSCANX.EXE; WHOSWATCHINGME.EXE;
      WINRECON.EXE; WNT.EXE; WRADMIN.EXE; WRCTRL.EXE; WSBGATE.EXE;
      WYVERNWORKSFIREWALL.EXE; XPF202EN.EXE; ZONALM2601.EXE; ZONEALARM.EXE


 Backdoor The following port is opened:

– winhost.exe on TCP port 9035


Contact server:
One of the following:
   • http://64.12.**********/in.php
   • http://64.246.**********/init.php
   • http://68.24.**********/in.php
   • http://biiig.**********/init.php
   • http://blockism.**********/img/ini.php
   • http://motivethree.**********/img/in.php
   • http://nine-one**********/images/in.php
   • http://paromy.**********/_old_img/in.php
   • http://**********.com/init.php
   • http://**********forum.ru/init.php
   • http://**********2k.com/img/ini.php
   • http://**********phops.com
   • http://**********arisi.net/init.php
   • http://www.card**********.com/img/ini.php
   • http://www.evo**********.com/img/in.php
   • http://www.lady**********.com/in.php
   • http://za**********.net/init.php


 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • FSG 1.33

Description inserted by Iulia Diaconescu on Monday, October 10, 2005
Description updated by Iulia Diaconescu on Monday, October 17, 2005

Back . . . .