TR/Bagle.CQ.5.1 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Bagle.CQ.5.1
Date discovered:	20/09/2005
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	95.664 Bytes
MD5 checksum:	66099e1754133a63c62bec9de0f6c640
VDF version:	6.32.0.26

General Method of propagation:
   • No own spreading routine

Aliases:
   • Symantec: Trojan
   • Mcafee: W32/Bagle.co
   • Kaspersky: Email-Worm.Win32.Bagle.dc
   • TrendMicro: TROJ_FANTIBAG.C
   • VirusBuster: I-Worm.Bagle.DT
   • Bitdefender: Win32.Bagle.DC@mm

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Blocks access to security websites
   • Drops a malicious file
   • Registry modification

Files It copies itself to the following location:
• %WINDIR%\firewall_anti.exe

The following file is created:

– %WINDIR%\firewall_anti.exe.dll Further investigation pointed out that this file is malware, too. Detected as: TR/Bagle.CQ.5

Registry The following registry key is added in order to run the process after reboot:

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • "firewall_anti"="%WINDIR%\firewall_anti.exe"

The following registry keys are added in order to load the service after reboot:

– HKLM\SYSTEM\CurrentControlSet\Services\IpFilterDriver\Enum
   • "0"="Root\\LEGACY_IPFILTERDRIVER\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

The following registry keys are added:

– HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPFILTERDRIVER
   • "NextInstance"=dword:00000001

– HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPFILTERDRIVER\0000
   • "Service"="IpFilterDriver"
   • "Legacy"=dword:00000001
   • "ConfigFlags"=dword:00000000
   • "Class"="LegacyDriver"
   • "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
   • "DeviceDesc"="IP Traffic Filter Driver"

– HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPFILTERDRIVER\0000\
   Control
   • "*NewlyCreated*"=dword:00000000
   • "ActiveService"="IpFilterDriver"

Injection – It injects the following file into a process: %WINDIR%\firewall_anti.exe.dll

    Process name:
   • %WINDIR%\Explorer.exe

   If successful, the malware process terminates while the injected part remains active.

Purpose:
Access to the following websites is effectively blocked:
   • ftpav.ca.com; www.pandasoftware.com; pandasoftware.com; clamav.net;
      www.clamav.net; www.bitdefender.com; bitdefender.com;
      ravantivirus.com; www.ravantivirus.com; drweb.ru; www.drweb.com;
      drweb.com; antivir.de; www.antivir.de; 216.200.68.152; 212.113.20.69;
      63.210.193.12; 84.53.142.22; 84.53.142.6; kaspersky.ru; grisoft.com;
      www3.ca.com; www.viruslist.ru; www.viruslist.com; www.trendmicro.com;
      www.symantec.com; www.sophos.com; www.networkassociates.com;
      www.nai.com; www.my-etrust.com; www.mcafee.com; www.kaspersky.ru;
      www.kaspersky.com; www.kaspersky-labs.com; www.grisoft.com;
      www.fastclick.net; www.f-secure.com; www.awaps.net; www.avp.ru;
      www.avp.com; www.avp.ch; windowsupdate.microsoft.com; viruslist.ru;
      viruslist.com; vil.nai.com; us.mcafee.com;
      updates5.kaspersky-labs.com; updates4.kaspersky-labs.com;
      updates3.kaspersky-labs.com; updates2.kaspersky-labs.com;
      updates1.kaspersky-labs.com; updates.symantec.com;
      update.symantec.com; trendmicro.com; symantec.com;
      support.microsoft.com; spd.atdmt.com; sophos.com;
      service1.symantec.com; securityresponse.symantec.com; secure.nai.com;
      rads.mcafee.com; phx.corporate-ir.net; office.microsoft.com;
      networkassociates.com; nai.com; my-etrust.com; msdn.microsoft.com;
      media.fastclick.net; mcafee.com; mast.mcafee.com;
      liveupdate.symantecliveupdate.com; liveupdate.symantec.com;
      kaspersky.com; kaspersky-labs.com; ids.kaspersky-labs.com;
      go.microsoft.com; ftp.sophos.com; ftp.kasperskylab.ru;
      ftp.f-secure.com; ftp.downloads2.kaspersky-labs.com; ftp.avp.ch;
      fastclick.net; f-secure.com; engine.awaps.net;
      downloads4.kaspersky-labs.com; downloads3.kaspersky-labs.com;
      downloads2.kaspersky-labs.com; downloads1.kaspersky-labs.com;
      downloads.microsoft.com; downloads-us3.kaspersky-labs.com;
      downloads-us2.kaspersky-labs.com; downloads-us1.kaspersky-labs.com;
      downloads-eu1.kaspersky-labs.com; download.microsoft.com;
      download.mcafee.com; dispatch.mcafee.com; customer.symantec.com;
      clicks.atdmt.com; click.atdmt.com; www.ca.com; ca.com;
      banners.fastclick.net; banner.fastclick.net; awaps.net; avp.ru;
      avp.com; avp.ch; atdmt.com; ar.atwola.com; ads.fastclick.net;
      ad.fastclick.net; report.bitdefender.com; upgrade.bitdefender.com;
      ad.doubleclick.net

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Victor Tone on Tue, 20 Sep 2005 12:07 (GMT+1)
Description updated by Victor Tone on Thu, 29 Sep 2005 10:45 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back