Nom:Worm/Bagz.D.3
La date de la découverte:22/10/2004
Type:Ver
En circulation:Oui
Infections signalées Moyen à élevé
Potentiel de distribution:Moyen
Potentiel de destruction:Faible a moyen
Fichier statique:Non
Taille du fichier:~ 155.000 Octets
Version VDF:6.28.00.32

 Général Méthode de propagation:
   • Email


Les alias:
   •  Symantec: W32.Bagz.E@mm
   •  Mcafee: W32/Bagz.e@MM
   •  Kaspersky: Email-Worm.Win32.Bagz.d
   •  TrendMicro: WORM_BAGZ.D
   •  Sophos: W32/Bagz-D
   •  Grisoft: I-Worm/Bagz.D
   •  VirusBuster: I-Worm.Bagz.G


Plateformes / Systèmes d'exploitation:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Effets secondaires:
   • Il bloque l'accès aux certains sites web
   • Il bloque l'accès aux sites web de sécurité
   • Il crée des fichiers
   • Il crée des fichiers malveillants
   • Il emploie son propre moteur de courrier électronique
   • Il modifie des registres

 Fichiers Il s'autocopie dans les emplacements suivants:
   • %SYSDIR%\about.doc%espaces vides%.exe
   • %SYSDIR%\admin.doc%espaces vides%.exe
   • %SYSDIR%\archivator.doc%espaces vides%.exe
   • %SYSDIR%\archives.doc%espaces vides%.exe
   • %SYSDIR%\ataches.doc%espaces vides%.exe
   • %SYSDIR%\docs.doc%espaces vides%.exe
   • %SYSDIR%\documentation.doc%espaces vides%.exe
   • %SYSDIR%\help.doc%espaces vides%.exe
   • %SYSDIR%\inbox.doc%espaces vides%.exe
   • %SYSDIR%\manual.doc%espaces vides%.exe
   • %SYSDIR%\outbox.doc%espaces vides%.exe
   • %SYSDIR%\payment.doc%espaces vides%.exe
   • %SYSDIR%\photos.doc%espaces vides%.exe
   • %SYSDIR%\rar.doc%espaces vides%.exe
   • %SYSDIR%\readme.doc%espaces vides%.exe
   • %SYSDIR%\save.doc%espaces vides%.exe
   • %SYSDIR%\sysboot.doc%espaces vides%.exe
   • %SYSDIR%\zip.doc%espaces vides%.exe



Les fichiers suivants sont créés:

– Il crée les fichiers compressés suivants contenant une copie du malware:
   • %SYSDIR%\about.zip; %SYSDIR%\admin.zip; %SYSDIR%\archivator.zip;
      %SYSDIR%\archives.zip; %SYSDIR%\ataches.zip; %SYSDIR%\docs.zip;
      %SYSDIR%\documentation.zip; %SYSDIR%\help.zip; %SYSDIR%\inbox.zip;
      %SYSDIR%\manual.zip; %SYSDIR%\outbox.zip; %SYSDIR%\payment.zip;
      %SYSDIR%\photos.zip; %SYSDIR%\rar.zip; %SYSDIR%\readme.zip;
      %SYSDIR%\save.zip; %SYSDIR%\zip.zip

– %SYSDIR%\wdate.dll Ceci est un fichier texte non malveillant avec le contenu suivant:
   • %la date courante% %l'heure courante%

– %SYSDIR%\rpc32.exe Ensuite, il est exécuté après avoir été completment crée. Les investigations ultérieures ont prouvé que ce ficher est également un Malware. Détecté comme: Worm/Bagz.D.1

– %SYSDIR%\run32.exe Les investigations ultérieures ont prouvé que ce ficher est également un Malware. Détecté comme: Worm/Bagz.D.2

– %SYSDIR%\ipdb.dll

 Registre Les clés de registre suivantes sont ajoutée:

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32]
   • "Type"=dword:00000120
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000000
   • "ImagePath"=%SYSDIR%\rpc32.exe
   • "DisplayName"="Network Explorer"
   • "ObjectName"="LocalSystem"
   • "Description"="Starts and configures accessibility tools from one window "

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32\Security]
   • "Security"=%valeurs hexa%

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32\Enum]
   • "0"="Root\\LEGACY_RPC32\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

 Email Il contient un moteur SMTP intégré pour envoyer des emails. Une connexion directe avec le serveur destination sera établie. Les caractéristiques sont décrites ci-dessous:


De:
L'adresse de l'expéditeur est falsifiée.


A:
– Les adresses email trouvés dans des fichiers spécifiques du système.


Le format des emails:
 


Sujet: ASAP
Le corps:
   • Hi
     
     Did you get the previous document I attached for you?
     I resent it in this email just in case, because I
     really need you to check it out asap.
     
     Best Regards
 


Sujet: please responce
Le corps:
   • Hi
     
     I made a mistake and forgot to click attach
     on the previous email I sent you. Please give me
     your opinion on this opportunity when you get a chance.
     
     Best Regards
 


Sujet: Read this
Le corps:
   • Hi
     
     I was supposed to send you this document yesterday.
     Sorry for the delay, please forward this to your family if possible.
     It contains important info for both of you.
 


Sujet: urgent
Le corps:
   • Hi
     
     Sorry, I forgot to send an important
     document to you in that last email. I had an important phone call.
     Please checkout attached doc file when you have a moment.
     
     Best Regards
     
 


Sujet: toxic
Le corps:
   • Hi
     
     I was in a rush and I forgot to attach an important
     document. Please see attached doc file.
     
     Best Regards,
 


Sujet: contract
Le corps:
   • Sorry to bother you, but I am having a problem receiving your emails.
     I am responding to your last email in the attached file.
     Please get back to me if there is any problem reading the attachment.
 


Sujet: Money
Le corps:
   • I am responding to your last email in the attached file.
     I had a delivery problem with your inbox, so maybe you'll receive this now.
 


Sujet: office
Le corps:
   • Can you please check out the email I have attached?
     For some reason, I received only part of your last several emails.
     I want to make sure that there are no problems with either of our accounts.
 


Sujet: Have a nice day
Le corps:
   • This email is being sent as attachment because
     it was previously blocked by your email filters.
     Please view the attachment and respond.
     Thanks
 


Sujet: Hello
Le corps:
   • I resent this email as attachment because
     it was previously blocked by your email filters.
     Please read the attachment and respond.
     Thanks
 


Sujet: Russian's
Le corps:
   • I apologize, but I need you to verify
     that I have the correct contact info for you.
     My system crashed last weekend and
     I lost most of my friends and work contacts.
     Please check the attached (.pdf) and
     please let me know if your info is current.
 


Sujet: Amirecans
Le corps:
   • My last email to you was returned.
     The reason is that I am not currently
      added to your "allowed" contact list.
     Please add my updated contact info
     provided in the attached (.pdf) file
     so I can send you emails in the future.
     Sincerely
 


Sujet: attachments
Le corps:
   • I have updated my email address
     See the (.pdf) file attached and
     please respond if you have any questions.
     
 


Sujet: attach
Le corps:
   • We have made recent updates to our database.
     Please verify your mailing address on file is correct.
     We have attached a (.pdf) sheet for you to use for your response.
 


Sujet: waiting
Le corps:
   • Hello
     
     Our contact information has changed.
     See the attached (.pdf) sheet for details.
     
     Sincerely,
 


Sujet: best regards
Le corps:
   • ***URGENT: SERVICE SHUTDOWN NOTICE***
     Due to your failure to comply with our email
     Rules and Regulations, your email account has been
     temporarily suspended for 24 hours unless we are contacted regarding
     this situation.
     You must read the attached document for further
     instructions. Failure to comply will result in termination of your account.
     Regards,
     Net Operator
     ***URGENT: SERVICE SHUTDOWN NOTICE***
 


Sujet: Administrator
Le corps:
   • ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
     
     ,
     You are currently unable to send emails.
     This may be a billing issue.
     Please call the billing center.
     The
      for the billing office is located in the attached
     contact list for your convenience.
     ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
 


Sujet: Warning
Le corps:
   • ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
     Hello,
     
     The previous email you sent has been recognized as spam.
     This means your email was not delivered to your friend or client.
     You must open the attached file to receive more information.
     ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
 


Sujet: text
Le corps:
   • Hello,
     What version of windows you are using?
     This last document I received from you came out weird.
     Please see the attached word file and resend the file to me.
     Many thanks,
     User
 


Sujet: Vasia
Le corps:
   • Hello,
     My PC crashed while I was sending that last email.
     I have re-attached the document of yours that I discovered.
     Please read attached document and respond ASAP.
     Sincerely,
     User
 


Sujet: re: Andrey
Le corps:
   • Hello,
     Your email was sent in an INVALID format.
     To verify this email was sent from you,
     simply open the attached email (.eml) file
     and click yes in the sender options box.
     Thank You,
     User
 


Sujet: re: please
Le corps:
   • Hello,
      Your email was received.
     YOUR REPLY IS URGENT!
     Please view the attached text file for instructions.
     Regards,
     User
 


Sujet: re: order
Le corps:
   • Hello,
      I was in a hurry and I forgot to attach an important
      document. Please see attached.
      Best Regards,
     User
 


Sujet: Allert!
Le corps:
   • Hello,
      I resent this email as attachment because
      it was previously blocked by your email filters.
      Please read the attachment and respond.
     
     Thanks,User
     
 


Sujet: Att
Le corps:
   • Hello,
     Sorry, I forgot to attach the new contact information.
     Please view the attached (.pdf) contact sheet.
     Sincerely,
     User


Sujet:
Un des suivants:
   • Administrator; Allert!; Amirecans; Att; attach; attachments; best
      regards; contract; Have a nice day; Hello; Hi; Money; office; please
      responce; re: Andrey; re: order; re: please; Read this; Russian's;
      text; toxic; urgent; Vasia; waiting; Warning



Pièce jointe:
Le nom de fichier de l'attachement est un des suivants:
   • about.zip; admin.zip; archivator.zip; archives.zip; ataches.zip;
      docs.zip; documentation.zip; help.zip; inbox.zip; manual.zip;
      outbox.zip; payment.zip; photos.zip; rar.zip; readme.zip; save.zip;
      zip.zip; about.doc%espaces vides%.exe; admin.doc%espaces
      vides%.exe; archivator.doc%espaces vides%.exe;
      archives.doc%espaces vides%.exe; ataches.doc%espaces
      vides%.exe; docs.doc%espaces vides%.exe;
      documentation.doc%espaces vides%.exe; help.doc%espaces
      vides%.exe; inbox.doc%espaces vides%.exe;
      manual.doc%espaces vides%.exe; outbox.doc%espaces
      vides%.exe; payment.doc%espaces vides%.exe;
      photos.doc%espaces vides%.exe; rar.doc%espaces
      vides%.exe; readme.doc%espaces vides%.exe;
      save.doc%espaces vides%.exe; zip.doc%espaces vides%.exe

L'attachement est une copie du malware lui-même.



L'email pourrait ressembler à un des suivants:



 Envoie de messages Recherche des adresses:
Il cherche les fichiers suivants pour des adresses email:
   • .tbb
   • .tbi
   • .dbx
   • .htm
   • .txt


Éviter les adresses:
Il n'envoie pas des emails aux adresses contenant une des chaînes de caractères suivantes:
   • @avp; @foo; @iana; @messagelab; @microsoft; abuse; admin;
      administrator@; all@; anyone@; bsd; bugs@; cafee; certific; certs@;
      contact@; contract@; feste; free-av; f-secur; gold-; gold-certs@;
      google; help@; hostmaster@; icrosoft; info@; kasp; linux; listserv;
      local; netadmin@; news; nobody@; noone@; noreply; ntivi; oocies;
      panda; pgp; postmaster@; rating@; root@; samples; sopho; spam;
      support; support@; unix; update; webmaster@; winrar; winzip

 Hôtes Le fichier hôte est modifié, comme il est expliqué:

– Dans ce cas les entrées existantes sont écrasées

– L'accès aux liens URL suivants est effectivement bloqué :
   • ad.doubleclick.net; ad.fastclick.net; ads.fastclick.net;
      ar.atwola.com; atdmt.com; avp.ch; avp.com; avp.ru; awaps.net;
      banner.fastclick.net; banners.fastclick.net; ca.com; click.atdmt.com;
      clicks.atdmt.com; dispatch.mcafee.com; download.mcafee.com;
      download.microsoft.com; downloads.microsoft.com; engine.awaps.net;
      fastclick.net; f-secure.com; ftp.f-secure.com; ftp.sophos.com;
      go.microsoft.com; liveupdate.symantec.com; mast.mcafee.com;
      mcafee.com; media.fastclick.net; msdn.microsoft.com; my-etrust.com;
      nai.com; networkassociates.com; office.microsoft.com;
      phx.corporate-ir.net; secure.nai.com; securityresponse.symantec.com;
      service1.symantec.com; sophos.com; spd.atdmt.com;
      support.microsoft.com; symantec.com; update.symantec.com;
      updates.symantec.com; us.mcafee.com; vil.nai.com; viruslist.ru;
      windowsupdate.microsoft.com; www.avp.ch; www.avp.com; www.avp.ru;
      www.awaps.net; www.ca.com; www.fastclick.net; www.f-secure.com;
      www.kaspersky.ru; www.mcafee.com; www.my-etrust.com; www.nai.com;
      www.networkassociates.com; www.sophos.com; www.symantec.com;
      www.trendmicro.com; www.viruslist.ru; www3.ca.com




Le fichier hôte modifié ressemblera à ceci:


 Détails de fichier Langage de programmation:
 Le fichier a été écrit en MS Visual C++.


Logiciel de compression des fichiers exécutables:
Pour entraver la détection et pour réduire la taille du fichier il est compressé avec le logiciel de compression des exécutables suivant:
   • UPX

Description insérée par Andrei Ivanes le lundi 7 août 2006
Description mise à jour par Andrei Ivanes le lundi 7 août 2006

Retour . . . .