Worm/Bagle.FK - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Bagle.FK
Date discovered:	09/02/2006
Type:	Worm
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Medium to high
Damage Potential:	Low
Static file:	No
File size:	~ 26.000 Bytes
VDF version:	6.33.00.215 - Thu, 09 Feb 2006 13:19 (GMT+1)

General Method of propagation:
   • Email
   • Peer to Peer

Alias:
   • Bitdefender: Trojan.Downloader.Bagle.EO

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Uses its own Email engine
   • Registry modification

Right after execution the following information is displayed:

Files It copies itself to the following location:
   • %SYSDIR%\regmaping.exe

It copies itself to the following locations. Those files have random bytes appended so they may differ from the original one:
   • %SYSDIR%\regmaping.exeopen
   • %SYSDIR%\regmaping.exeopenopen

The following file is created:

– %WINDIR%\winresw.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: Worm/Bagle.FJ.2

Registry The following registry key is added in order to run the process after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Regmonitor"="%SYSDIR%\regmaping.exe"

The values of the following registry keys are removed:

– [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • 9XHtProtect
   • Antivirus
   • EasyAV
   • FirewallSvr
   • HtProtect
   • ICQ Net
   • ICQNet
   • Jammer2nd
   • KasperskyAVEng
   • MsInfo
   • My AV
   • NetDy
   • Norton Antivirus AV
   • PandaAVEngine
   • service
   • SkynetsRevenge
   • Special Firewall Service
   • SysMonXP
   • Tiny AV
   • Zone Labs Client Ex

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • 9XHtProtect
   • Antivirus
   • EasyAV
   • FirewallSvr
   • HtProtect
   • ICQ Net
   • ICQNet
   • Jammer2nd
   • KasperskyAVEng
   • MsInfo
   • My AV
   • NetDy
   • Norton Antivirus AV
   • PandaAVEngine
   • service
   • SkynetsRevenge
   • Special Firewall Service
   • SysMonXP
   • Tiny AV
   • Zone Labs Client Ex

Email It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:

To:
– Email addresses found in specific files on the system.

Subject:
One of the following:
   • Your Receipt %several random numbers from 0 to 9%
   • Billing department, order %several random numbers from 0 to 9%
   • Order reminder: ID %several random numbers from 0 to 9%

Body:
The body of the email is one of the following:

   • ******************************************************************

     Details about your reciept attached with this email. You have to use Adobe Acrobat Reader to open it.

     Transaction Number: %several random numbers from 0 to 9%
     This is your receipt for your $1490 purchase of a 1.0 months
     subscription which will appear on your statement as %several random numbers from 0 to 9%.
     Your membership will automatically renew per the terms and conditions.

     Should you ever have any
     problems whatsoever, please don't hesitate to contact our live technical support staff - available 24 hours a day 7 days a week. We can be reached by phone toll free in the US at 800-534-8593. Rather use email?
     Drop us a line at bill@gmail.com and we'll always get back to you within an hour.

     Enjoy the service?
     Support

     ******************************************************************

   • Your email %receiver's email address% has exceeded its
bandwidth quota in the period beginning on 2006-01-01.
Your quota is set to 10485760 bytes (10.0 MB), and
your email has consumed 559189702 bytes (533.285 MB) beyond that quota.

Our over-bandwidth charges are
Additional Bandwidth/Month Monthly Cost
100 Mb $200.00
200 MB $360.00
300 MB $480.00
400 MB $624.00
500 Mb $740.00 <- your over-usage
600 Mb $850.00

Our automatically generated bill is attached with this email.

Sincerely,
Sales Manager.



   • Dear Sir or Madam,

     This notification is just a friendly reminder (not a bill or a second charge) that on 15-JAN-06, you placed an order from Symantec Store. This order was paid using your Visa, whose last 4 digits are ************2346, and will be appearing on your billing statement shortly. The charge will appear as DR *Symantec. This is just a reminder to help you recognize the charge. You will not be charged again.
     You antivirus definition file is attached to this email, please install it to be perfectly protected from the latest viruses and other internet threats.

Attachment:
The filename of the attachment is one of the following:
   • Order_details.exe
   • Service_receipt.exe
   • Generated_bill.exe

The attachment is a copy of the malware itself.

Mailing Search addresses:
It searches the following files for email addresses:
   • .wab; .txt; .msg; .htm; .shtm; .stm; .xml; .dbx; .mbx; .mdx; .eml;
      .nch; .mmf; .ods; .cfg; .asp; .php; .wsh; .adb; .tbb; .sht; .xls;
      .oft; .uin; .cgi; .mht; .dhtm; .jsp

Avoid addresses:
It does not send emails to addresses containing one of the following strings:
   • @hotmail; @msn; @microsoft; rating@; f-secur; news; update; anyone@;
      bugs@; contract@; feste; gold-certs@; help@; info@; nobody@; noone@;
      kasp; admin; icrosoft; support; ntivi; unix; bsd; linux; listserv;
      certific; sopho; @foo; @iana; free-av; @messagelab; winzip; google;
      winrar; samples; abuse; panda; cafee; spam; pgp; @avp.; noreply;
      local; root@; postmaster@

P2P In order to infect other systems in the Peer to Peer network community the following action is performed:   It searches for directories that contain the following substring:
   • shar

   If successful, the following files are created:
   • Adobe Photoshop 9 full.exe; Ahead Nero 10.exe; anna benson sex
      video.exe; barrett jackson nude photos, movies, porn video.exe;
      Britney Spears sex photos.exe; IE beta 7.exe; jenna elfman sex anal
      deepthroat; kate beckinsale nude pictures.exe; miss america Porno,
      sex, oral, anal cool, awesome!!.exe; paris hilton Porno pics arhive,
      xxx.exe; Porno Screensaver.scr; Serials 2005 database.exe;
      Serials.txt.exe; Windown Vista Beta Leak.exe; Windows Sourcecode
      update.doc.exe; XXX hardcore images.exe

   These files are copies of the malware itself.

Backdoor The following port is opened:

– %SYSDIR%\regmaping.exe on TCP port 6777

Contact server:
The following:
• http://ijj.t**********

As a result it may send some information.

Sends information about:
• Current malware status

Miscellaneous Mutex:
It creates the following Mutexes:
   • MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D
   • 'D'r'o'p'p'e'd'S'k'y'N'e't'
   • _-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
   • [SkyNet.cz]SystemsMutex
   • AdmSkynetJklS003
   • ____--->>>>U<<<<--____
   • _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_
   • smtp_bagla_1000

String:
Furthermore it contains the following string:
   • In a difficult world
In a nameless time
I want to survive
So, you will be mine!!
-- Bagle Author, 29.04.04, Germany.

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX

See a brief description here.

Description inserted by Andrei Ivanes on Thu, 09 Feb 2006 14:59 (GMT+1)
Description updated by Andrei Ivanes on Fri, 10 Feb 2006 10:35 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back