Nome del virus:Worm/Bagz.D.3
Scoperto:22/10/2004
Tipo:Worm
In circolazione (ITW):Si
Numero delle infezioni segnalate:Medio-Alto
Potenziale di propagazione:Medio
Potenziale di danni:Medio-Basso
File statico:No
Dimensione del file:~ 155.000 Byte
Versione VDF:6.28.00.32

 Generale Metodo di propagazione:
   • Email


Alias:
   •  Symantec: W32.Bagz.E@mm
   •  Mcafee: W32/Bagz.e@MM
   •  Kaspersky: Email-Worm.Win32.Bagz.d
   •  TrendMicro: WORM_BAGZ.D
   •  Sophos: W32/Bagz-D
   •  Grisoft: I-Worm/Bagz.D
   •  VirusBuster: I-Worm.Bagz.G


Piattaforme / Sistemi operativi:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Effetti secondari:
   • Blocca l'accesso a certi siti web
   • Blocca l'accesso a siti web di sicurezza
   • Duplica file
   • Duplica file “maligni”
   • Utilizza un proprio motore SMTP per l'invio di email
   • Modifica del registro

 File Si copia alle seguenti posizioni:
   • %SYSDIR%\about.doc%spazi vuoti%.exe
   • %SYSDIR%\admin.doc%spazi vuoti%.exe
   • %SYSDIR%\archivator.doc%spazi vuoti%.exe
   • %SYSDIR%\archives.doc%spazi vuoti%.exe
   • %SYSDIR%\ataches.doc%spazi vuoti%.exe
   • %SYSDIR%\docs.doc%spazi vuoti%.exe
   • %SYSDIR%\documentation.doc%spazi vuoti%.exe
   • %SYSDIR%\help.doc%spazi vuoti%.exe
   • %SYSDIR%\inbox.doc%spazi vuoti%.exe
   • %SYSDIR%\manual.doc%spazi vuoti%.exe
   • %SYSDIR%\outbox.doc%spazi vuoti%.exe
   • %SYSDIR%\payment.doc%spazi vuoti%.exe
   • %SYSDIR%\photos.doc%spazi vuoti%.exe
   • %SYSDIR%\rar.doc%spazi vuoti%.exe
   • %SYSDIR%\readme.doc%spazi vuoti%.exe
   • %SYSDIR%\save.doc%spazi vuoti%.exe
   • %SYSDIR%\sysboot.doc%spazi vuoti%.exe
   • %SYSDIR%\zip.doc%spazi vuoti%.exe



Vengono creati i seguenti file:

– Crea i seguenti archivi contenenti una copia del malware:
   • %SYSDIR%\about.zip; %SYSDIR%\admin.zip; %SYSDIR%\archivator.zip;
      %SYSDIR%\archives.zip; %SYSDIR%\ataches.zip; %SYSDIR%\docs.zip;
      %SYSDIR%\documentation.zip; %SYSDIR%\help.zip; %SYSDIR%\inbox.zip;
      %SYSDIR%\manual.zip; %SYSDIR%\outbox.zip; %SYSDIR%\payment.zip;
      %SYSDIR%\photos.zip; %SYSDIR%\rar.zip; %SYSDIR%\readme.zip;
      %SYSDIR%\save.zip; %SYSDIR%\zip.zip

– %SYSDIR%\wdate.dll Questo è un file di testo “non maligno” con il seguente contenuto:
   • %data corrente% %ora corrente%

– %SYSDIR%\rpc32.exe Viene eseguito ulteriormente dopo che è stato completamente creato. Ulteriori analisi hanno accertato che questo file è anch'esso un malware. Riconosciuto come: Worm/Bagz.D.1

– %SYSDIR%\run32.exe Ulteriori analisi hanno accertato che questo file è anch'esso un malware. Riconosciuto come: Worm/Bagz.D.2

– %SYSDIR%\ipdb.dll

 Registro Vengono aggiunte le seguenti chiavi di registro:

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32]
   • "Type"=dword:00000120
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000000
   • "ImagePath"=%SYSDIR%\rpc32.exe
   • "DisplayName"="Network Explorer"
   • "ObjectName"="LocalSystem"
   • "Description"="Starts and configures accessibility tools from one window "

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32\Security]
   • "Security"=%valori esadecimali%

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32\Enum]
   • "0"="Root\\LEGACY_RPC32\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

 Email Contiene un motore SMTP integrato per inviare le email. Verrà stabilita una connessione diretta con il server di destinazione. Le caratteristiche sono descritte di seguito:


Da:
L'indirizzo del mittente è falso.


A:
– Indirizzi email trovati in specifici file sul sistema.


Design delle email:



Oggetto: ASAP
Corpo della mail:
   • Hi
     
     Did you get the previous document I attached for you?
     I resent it in this email just in case, because I
     really need you to check it out asap.
     
     Best Regards



Oggetto: please responce
Corpo della mail:
   • Hi
     
     I made a mistake and forgot to click attach
     on the previous email I sent you. Please give me
     your opinion on this opportunity when you get a chance.
     
     Best Regards



Oggetto: Read this
Corpo della mail:
   • Hi
     
     I was supposed to send you this document yesterday.
     Sorry for the delay, please forward this to your family if possible.
     It contains important info for both of you.



Oggetto: urgent
Corpo della mail:
   • Hi
     
     Sorry, I forgot to send an important
     document to you in that last email. I had an important phone call.
     Please checkout attached doc file when you have a moment.
     
     Best Regards
     



Oggetto: toxic
Corpo della mail:
   • Hi
     
     I was in a rush and I forgot to attach an important
     document. Please see attached doc file.
     
     Best Regards,



Oggetto: contract
Corpo della mail:
   • Sorry to bother you, but I am having a problem receiving your emails.
     I am responding to your last email in the attached file.
     Please get back to me if there is any problem reading the attachment.



Oggetto: Money
Corpo della mail:
   • I am responding to your last email in the attached file.
     I had a delivery problem with your inbox, so maybe you'll receive this now.



Oggetto: office
Corpo della mail:
   • Can you please check out the email I have attached?
     For some reason, I received only part of your last several emails.
     I want to make sure that there are no problems with either of our accounts.



Oggetto: Have a nice day
Corpo della mail:
   • This email is being sent as attachment because
     it was previously blocked by your email filters.
     Please view the attachment and respond.
     Thanks



Oggetto: Hello
Corpo della mail:
   • I resent this email as attachment because
     it was previously blocked by your email filters.
     Please read the attachment and respond.
     Thanks



Oggetto: Russian's
Corpo della mail:
   • I apologize, but I need you to verify
     that I have the correct contact info for you.
     My system crashed last weekend and
     I lost most of my friends and work contacts.
     Please check the attached (.pdf) and
     please let me know if your info is current.



Oggetto: Amirecans
Corpo della mail:
   • My last email to you was returned.
     The reason is that I am not currently
      added to your "allowed" contact list.
     Please add my updated contact info
     provided in the attached (.pdf) file
     so I can send you emails in the future.
     Sincerely



Oggetto: attachments
Corpo della mail:
   • I have updated my email address
     See the (.pdf) file attached and
     please respond if you have any questions.
     



Oggetto: attach
Corpo della mail:
   • We have made recent updates to our database.
     Please verify your mailing address on file is correct.
     We have attached a (.pdf) sheet for you to use for your response.



Oggetto: waiting
Corpo della mail:
   • Hello
     
     Our contact information has changed.
     See the attached (.pdf) sheet for details.
     
     Sincerely,



Oggetto: best regards
Corpo della mail:
   • ***URGENT: SERVICE SHUTDOWN NOTICE***
     Due to your failure to comply with our email
     Rules and Regulations, your email account has been
     temporarily suspended for 24 hours unless we are contacted regarding
     this situation.
     You must read the attached document for further
     instructions. Failure to comply will result in termination of your account.
     Regards,
     Net Operator
     ***URGENT: SERVICE SHUTDOWN NOTICE***



Oggetto: Administrator
Corpo della mail:
   • ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
     
     ,
     You are currently unable to send emails.
     This may be a billing issue.
     Please call the billing center.
     The
      for the billing office is located in the attached
     contact list for your convenience.
     ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***



Oggetto: Warning
Corpo della mail:
   • ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
     Hello,
     
     The previous email you sent has been recognized as spam.
     This means your email was not delivered to your friend or client.
     You must open the attached file to receive more information.
     ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***



Oggetto: text
Corpo della mail:
   • Hello,
     What version of windows you are using?
     This last document I received from you came out weird.
     Please see the attached word file and resend the file to me.
     Many thanks,
     User



Oggetto: Vasia
Corpo della mail:
   • Hello,
     My PC crashed while I was sending that last email.
     I have re-attached the document of yours that I discovered.
     Please read attached document and respond ASAP.
     Sincerely,
     User



Oggetto: re: Andrey
Corpo della mail:
   • Hello,
     Your email was sent in an INVALID format.
     To verify this email was sent from you,
     simply open the attached email (.eml) file
     and click yes in the sender options box.
     Thank You,
     User



Oggetto: re: please
Corpo della mail:
   • Hello,
      Your email was received.
     YOUR REPLY IS URGENT!
     Please view the attached text file for instructions.
     Regards,
     User



Oggetto: re: order
Corpo della mail:
   • Hello,
      I was in a hurry and I forgot to attach an important
      document. Please see attached.
      Best Regards,
     User



Oggetto: Allert!
Corpo della mail:
   • Hello,
      I resent this email as attachment because
      it was previously blocked by your email filters.
      Please read the attachment and respond.
     
     Thanks,User
     



Oggetto: Att
Corpo della mail:
   • Hello,
     Sorry, I forgot to attach the new contact information.
     Please view the attached (.pdf) contact sheet.
     Sincerely,
     User


Oggetto:
Uno dei seguenti:
   • Administrator; Allert!; Amirecans; Att; attach; attachments; best
      regards; contract; Have a nice day; Hello; Hi; Money; office; please
      responce; re: Andrey; re: order; re: please; Read this; Russian's;
      text; toxic; urgent; Vasia; waiting; Warning



File allegato:
Il nome del file allegato è uno dei seguenti:
   • about.zip; admin.zip; archivator.zip; archives.zip; ataches.zip;
      docs.zip; documentation.zip; help.zip; inbox.zip; manual.zip;
      outbox.zip; payment.zip; photos.zip; rar.zip; readme.zip; save.zip;
      zip.zip; about.doc%spazi vuoti%.exe; admin.doc%spazi
      vuoti%.exe; archivator.doc%spazi vuoti%.exe;
      archives.doc%spazi vuoti%.exe; ataches.doc%spazi
      vuoti%.exe; docs.doc%spazi vuoti%.exe;
      documentation.doc%spazi vuoti%.exe; help.doc%spazi
      vuoti%.exe; inbox.doc%spazi vuoti%.exe; manual.doc%spazi
      vuoti%.exe; outbox.doc%spazi vuoti%.exe;
      payment.doc%spazi vuoti%.exe; photos.doc%spazi
      vuoti%.exe; rar.doc%spazi vuoti%.exe; readme.doc%spazi
      vuoti%.exe; save.doc%spazi vuoti%.exe; zip.doc%spazi
      vuoti%.exe

L'allegato è una copia del malware stesso.



L'email può presentarsi come una delle seguenti:



 Invio di messaggi Cerca indirizzi:
Cerca i seguenti file per gli indirizzi email:
   • .tbb
   • .tbi
   • .dbx
   • .htm
   • .txt


Evita indirizzi:
Non invia email agli indirizzi che contengono una delle seguenti stringhe:
   • @avp; @foo; @iana; @messagelab; @microsoft; abuse; admin;
      administrator@; all@; anyone@; bsd; bugs@; cafee; certific; certs@;
      contact@; contract@; feste; free-av; f-secur; gold-; gold-certs@;
      google; help@; hostmaster@; icrosoft; info@; kasp; linux; listserv;
      local; netadmin@; news; nobody@; noone@; noreply; ntivi; oocies;
      panda; pgp; postmaster@; rating@; root@; samples; sopho; spam;
      support; support@; unix; update; webmaster@; winrar; winzip

 Host L'host del file viene modificato come spiegato:

– In questo caso i dati immessi già esistenti vengono cancellati.

– L'accesso ai seguenti domini è effettivamente bloccato:
   • ad.doubleclick.net; ad.fastclick.net; ads.fastclick.net;
      ar.atwola.com; atdmt.com; avp.ch; avp.com; avp.ru; awaps.net;
      banner.fastclick.net; banners.fastclick.net; ca.com; click.atdmt.com;
      clicks.atdmt.com; dispatch.mcafee.com; download.mcafee.com;
      download.microsoft.com; downloads.microsoft.com; engine.awaps.net;
      fastclick.net; f-secure.com; ftp.f-secure.com; ftp.sophos.com;
      go.microsoft.com; liveupdate.symantec.com; mast.mcafee.com;
      mcafee.com; media.fastclick.net; msdn.microsoft.com; my-etrust.com;
      nai.com; networkassociates.com; office.microsoft.com;
      phx.corporate-ir.net; secure.nai.com; securityresponse.symantec.com;
      service1.symantec.com; sophos.com; spd.atdmt.com;
      support.microsoft.com; symantec.com; update.symantec.com;
      updates.symantec.com; us.mcafee.com; vil.nai.com; viruslist.ru;
      windowsupdate.microsoft.com; www.avp.ch; www.avp.com; www.avp.ru;
      www.awaps.net; www.ca.com; www.fastclick.net; www.f-secure.com;
      www.kaspersky.ru; www.mcafee.com; www.my-etrust.com; www.nai.com;
      www.networkassociates.com; www.sophos.com; www.symantec.com;
      www.trendmicro.com; www.viruslist.ru; www3.ca.com




L'host del file modificato sarà del tipo:


 Dettagli del file Linguaggio di programmazione:
 Il malware è stato scritto in MS Visual C++.


Software di compressione:
Per complicarne l'individuazione e ridurre la dimensione del file, viene compresso con il seguente software di compressione:
   • UPX

Descrizione inserita da Andrei Ivanes su lunedì 7 agosto 2006
Descrizione aggiornata da Andrei Ivanes su lunedì 7 agosto 2006

Indietro . . . .