Nume:Worm/Bagz.D.3
Descoperit pe data de:22/10/2004
Tip:Vierme
ITW:Da
Numar infectii raportate:Mediu spre ridicat
Potential de raspandire:Mediu
Potential de distrugere:Scazut spre mediu
Fisier static:Nu
Marime:~ 155.000 Bytes
Versiune VDF:6.28.00.32

 General Metoda de raspandire:
   • Email


Alias:
   •  Symantec: W32.Bagz.E@mm
   •  Mcafee: W32/Bagz.e@MM
   •  Kaspersky: Email-Worm.Win32.Bagz.d
   •  TrendMicro: WORM_BAGZ.D
   •  Sophos: W32/Bagz-D
   •  Grisoft: I-Worm/Bagz.D
   •  VirusBuster: I-Worm.Bagz.G


Sistem de operare:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Efecte secundare:
   • Blocheaza accesul la anumite website-uri
   • Blocheaza accesul la website-uri ale firmelor de securitate
   • Creeaza fisiere
   • Creeaza fisiere malware
   • Utilizeaza propriul motor de email
   • Modificari in registri

 Fisiere Se copiaza in urmatoarele locatii:
   • %SYSDIR%\about.doc%spatii libere%.exe
   • %SYSDIR%\admin.doc%spatii libere%.exe
   • %SYSDIR%\archivator.doc%spatii libere%.exe
   • %SYSDIR%\archives.doc%spatii libere%.exe
   • %SYSDIR%\ataches.doc%spatii libere%.exe
   • %SYSDIR%\docs.doc%spatii libere%.exe
   • %SYSDIR%\documentation.doc%spatii libere%.exe
   • %SYSDIR%\help.doc%spatii libere%.exe
   • %SYSDIR%\inbox.doc%spatii libere%.exe
   • %SYSDIR%\manual.doc%spatii libere%.exe
   • %SYSDIR%\outbox.doc%spatii libere%.exe
   • %SYSDIR%\payment.doc%spatii libere%.exe
   • %SYSDIR%\photos.doc%spatii libere%.exe
   • %SYSDIR%\rar.doc%spatii libere%.exe
   • %SYSDIR%\readme.doc%spatii libere%.exe
   • %SYSDIR%\save.doc%spatii libere%.exe
   • %SYSDIR%\sysboot.doc%spatii libere%.exe
   • %SYSDIR%\zip.doc%spatii libere%.exe



Sunt create fisierele:

– Creeaza urmatoarele arhive ce contin copii malware:
   • %SYSDIR%\about.zip; %SYSDIR%\admin.zip; %SYSDIR%\archivator.zip;
      %SYSDIR%\archives.zip; %SYSDIR%\ataches.zip; %SYSDIR%\docs.zip;
      %SYSDIR%\documentation.zip; %SYSDIR%\help.zip; %SYSDIR%\inbox.zip;
      %SYSDIR%\manual.zip; %SYSDIR%\outbox.zip; %SYSDIR%\payment.zip;
      %SYSDIR%\photos.zip; %SYSDIR%\rar.zip; %SYSDIR%\readme.zip;
      %SYSDIR%\save.zip; %SYSDIR%\zip.zip

– %SYSDIR%\wdate.dll Acesta este un fisier text care nu prezinta pericol si are urmatorul continut:
   • %data curenta% %ora curenta%

– %SYSDIR%\rpc32.exe Fisierul este executat dupa ce a fost creat. Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: Worm/Bagz.D.1

– %SYSDIR%\run32.exe Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: Worm/Bagz.D.2

– %SYSDIR%\ipdb.dll

 Registrii sistemului Urmatoarele chei sunt adaugate in registrii sistemului:

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32]
   • "Type"=dword:00000120
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000000
   • "ImagePath"=%SYSDIR%\rpc32.exe
   • "DisplayName"="Network Explorer"
   • "ObjectName"="LocalSystem"
   • "Description"="Starts and configures accessibility tools from one window "

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32\Security]
   • "Security"=%valori hex%

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32\Enum]
   • "0"="Root\\LEGACY_RPC32\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

 Email Are un motor SMTP integrat. Va fi facuta o conexiune directa cu serverul destinatar. Iata caracteristicile lui:


De la:
Adresa este falsificata.


Catre:
– Adrese de email gasite pe sistem.


Formatul email-urilor:
 


Subiect: ASAP
Corp mesaj:
   • Hi
     
     Did you get the previous document I attached for you?
     I resent it in this email just in case, because I
     really need you to check it out asap.
     
     Best Regards
 


Subiect: please responce
Corp mesaj:
   • Hi
     
     I made a mistake and forgot to click attach
     on the previous email I sent you. Please give me
     your opinion on this opportunity when you get a chance.
     
     Best Regards
 


Subiect: Read this
Corp mesaj:
   • Hi
     
     I was supposed to send you this document yesterday.
     Sorry for the delay, please forward this to your family if possible.
     It contains important info for both of you.
 


Subiect: urgent
Corp mesaj:
   • Hi
     
     Sorry, I forgot to send an important
     document to you in that last email. I had an important phone call.
     Please checkout attached doc file when you have a moment.
     
     Best Regards
     
 


Subiect: toxic
Corp mesaj:
   • Hi
     
     I was in a rush and I forgot to attach an important
     document. Please see attached doc file.
     
     Best Regards,
 


Subiect: contract
Corp mesaj:
   • Sorry to bother you, but I am having a problem receiving your emails.
     I am responding to your last email in the attached file.
     Please get back to me if there is any problem reading the attachment.
 


Subiect: Money
Corp mesaj:
   • I am responding to your last email in the attached file.
     I had a delivery problem with your inbox, so maybe you'll receive this now.
 


Subiect: office
Corp mesaj:
   • Can you please check out the email I have attached?
     For some reason, I received only part of your last several emails.
     I want to make sure that there are no problems with either of our accounts.
 


Subiect: Have a nice day
Corp mesaj:
   • This email is being sent as attachment because
     it was previously blocked by your email filters.
     Please view the attachment and respond.
     Thanks
 


Subiect: Hello
Corp mesaj:
   • I resent this email as attachment because
     it was previously blocked by your email filters.
     Please read the attachment and respond.
     Thanks
 


Subiect: Russian's
Corp mesaj:
   • I apologize, but I need you to verify
     that I have the correct contact info for you.
     My system crashed last weekend and
     I lost most of my friends and work contacts.
     Please check the attached (.pdf) and
     please let me know if your info is current.
 


Subiect: Amirecans
Corp mesaj:
   • My last email to you was returned.
     The reason is that I am not currently
      added to your "allowed" contact list.
     Please add my updated contact info
     provided in the attached (.pdf) file
     so I can send you emails in the future.
     Sincerely
 


Subiect: attachments
Corp mesaj:
   • I have updated my email address
     See the (.pdf) file attached and
     please respond if you have any questions.
     
 


Subiect: attach
Corp mesaj:
   • We have made recent updates to our database.
     Please verify your mailing address on file is correct.
     We have attached a (.pdf) sheet for you to use for your response.
 


Subiect: waiting
Corp mesaj:
   • Hello
     
     Our contact information has changed.
     See the attached (.pdf) sheet for details.
     
     Sincerely,
 


Subiect: best regards
Corp mesaj:
   • ***URGENT: SERVICE SHUTDOWN NOTICE***
     Due to your failure to comply with our email
     Rules and Regulations, your email account has been
     temporarily suspended for 24 hours unless we are contacted regarding
     this situation.
     You must read the attached document for further
     instructions. Failure to comply will result in termination of your account.
     Regards,
     Net Operator
     ***URGENT: SERVICE SHUTDOWN NOTICE***
 


Subiect: Administrator
Corp mesaj:
   • ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
     
     ,
     You are currently unable to send emails.
     This may be a billing issue.
     Please call the billing center.
     The
      for the billing office is located in the attached
     contact list for your convenience.
     ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
 


Subiect: Warning
Corp mesaj:
   • ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
     Hello,
     
     The previous email you sent has been recognized as spam.
     This means your email was not delivered to your friend or client.
     You must open the attached file to receive more information.
     ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
 


Subiect: text
Corp mesaj:
   • Hello,
     What version of windows you are using?
     This last document I received from you came out weird.
     Please see the attached word file and resend the file to me.
     Many thanks,
     User
 


Subiect: Vasia
Corp mesaj:
   • Hello,
     My PC crashed while I was sending that last email.
     I have re-attached the document of yours that I discovered.
     Please read attached document and respond ASAP.
     Sincerely,
     User
 


Subiect: re: Andrey
Corp mesaj:
   • Hello,
     Your email was sent in an INVALID format.
     To verify this email was sent from you,
     simply open the attached email (.eml) file
     and click yes in the sender options box.
     Thank You,
     User
 


Subiect: re: please
Corp mesaj:
   • Hello,
      Your email was received.
     YOUR REPLY IS URGENT!
     Please view the attached text file for instructions.
     Regards,
     User
 


Subiect: re: order
Corp mesaj:
   • Hello,
      I was in a hurry and I forgot to attach an important
      document. Please see attached.
      Best Regards,
     User
 


Subiect: Allert!
Corp mesaj:
   • Hello,
      I resent this email as attachment because
      it was previously blocked by your email filters.
      Please read the attachment and respond.
     
     Thanks,User
     
 


Subiect: Att
Corp mesaj:
   • Hello,
     Sorry, I forgot to attach the new contact information.
     Please view the attached (.pdf) contact sheet.
     Sincerely,
     User


Subiect:
Unul din urmatoarele:
   • Administrator; Allert!; Amirecans; Att; attach; attachments; best
      regards; contract; Have a nice day; Hello; Hi; Money; office; please
      responce; re: Andrey; re: order; re: please; Read this; Russian's;
      text; toxic; urgent; Vasia; waiting; Warning



Atasament:
Numele fisierului atasat este unul din urmatoarele:
   • about.zip; admin.zip; archivator.zip; archives.zip; ataches.zip;
      docs.zip; documentation.zip; help.zip; inbox.zip; manual.zip;
      outbox.zip; payment.zip; photos.zip; rar.zip; readme.zip; save.zip;
      zip.zip; about.doc%spatii libere%.exe; admin.doc%spatii
      libere%.exe; archivator.doc%spatii libere%.exe;
      archives.doc%spatii libere%.exe; ataches.doc%spatii
      libere%.exe; docs.doc%spatii libere%.exe;
      documentation.doc%spatii libere%.exe; help.doc%spatii
      libere%.exe; inbox.doc%spatii libere%.exe;
      manual.doc%spatii libere%.exe; outbox.doc%spatii
      libere%.exe; payment.doc%spatii libere%.exe;
      photos.doc%spatii libere%.exe; rar.doc%spatii
      libere%.exe; readme.doc%spatii libere%.exe;
      save.doc%spatii libere%.exe; zip.doc%spatii libere%.exe

Atasamentul este o copie malware.



Email-ul poate arata ca unul din urmatoarele:



 Email Cautare adrese:
Cauta adrese de email in urmatoarele fisiere:
   • .tbb
   • .tbi
   • .dbx
   • .htm
   • .txt


Adrese evitate:
Nu trimite email-uri la adrese care contin unul din urmatoarele siruri de caractere:
   • @avp; @foo; @iana; @messagelab; @microsoft; abuse; admin;
      administrator@; all@; anyone@; bsd; bugs@; cafee; certific; certs@;
      contact@; contract@; feste; free-av; f-secur; gold-; gold-certs@;
      google; help@; hostmaster@; icrosoft; info@; kasp; linux; listserv;
      local; netadmin@; news; nobody@; noone@; noreply; ntivi; oocies;
      panda; pgp; postmaster@; rating@; root@; samples; sopho; spam;
      support; support@; unix; update; webmaster@; winrar; winzip

 Fisiere host Fisierul

– In acest caz, inregistrarile existente sunt sterse.

– Accesul la urmatoarele domenii este blocat:
   • ad.doubleclick.net; ad.fastclick.net; ads.fastclick.net;
      ar.atwola.com; atdmt.com; avp.ch; avp.com; avp.ru; awaps.net;
      banner.fastclick.net; banners.fastclick.net; ca.com; click.atdmt.com;
      clicks.atdmt.com; dispatch.mcafee.com; download.mcafee.com;
      download.microsoft.com; downloads.microsoft.com; engine.awaps.net;
      fastclick.net; f-secure.com; ftp.f-secure.com; ftp.sophos.com;
      go.microsoft.com; liveupdate.symantec.com; mast.mcafee.com;
      mcafee.com; media.fastclick.net; msdn.microsoft.com; my-etrust.com;
      nai.com; networkassociates.com; office.microsoft.com;
      phx.corporate-ir.net; secure.nai.com; securityresponse.symantec.com;
      service1.symantec.com; sophos.com; spd.atdmt.com;
      support.microsoft.com; symantec.com; update.symantec.com;
      updates.symantec.com; us.mcafee.com; vil.nai.com; viruslist.ru;
      windowsupdate.microsoft.com; www.avp.ch; www.avp.com; www.avp.ru;
      www.awaps.net; www.ca.com; www.fastclick.net; www.f-secure.com;
      www.kaspersky.ru; www.mcafee.com; www.my-etrust.com; www.nai.com;
      www.networkassociates.com; www.sophos.com; www.symantec.com;
      www.trendmicro.com; www.viruslist.ru; www3.ca.com




Fisierul hosts modificat va arata astfel:


 Detaliile fisierului Limbaj de programare:
 Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).


Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit urmatorul program de arhivare:
   • UPX

Description inserted by Andrei Ivanes on Monday, August 7, 2006
Description updated by Andrei Ivanes on Monday, August 7, 2006

Back . . . .