Nume:Worm/Bagle.GC
Descoperit pe data de:30/11/2006
Tip:Vierme
ITW:Da
Numar infectii raportate:Scazut
Potential de raspandire:Mediu
Potential de distrugere:Mediu
Fisier static:Da
Marime:188.422 Bytes
MD5:23e143e87ff2fb1be5a3e2b2d93ce283
Versiune VDF:6.36.01.108
Versiune IVDF:6.36.01.113
Euristica:HEUR/Crypted

 General Metoda de raspandire:
   • Email


Alias:
   •  Kaspersky: Email-Worm.Win32.Bagle.gr
   •  F-Secure: W32/Bagle.GO
   •  Sophos: W32/Bagle-QS
   •  Grisoft: I-Worm/Bagle.OI
   •  Eset: Win32/Bagle.HB

Initial identificat ca:
   •  TR/Bagle.GC


Sistem de operare:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Efecte secundare:
   • Inchide aplicatiile de securitate
   • Descarca fisiere
   • Creeaza un fisier malware
   • Utilizeaza propriul motor de email
   • Reduce setarile de securitate
   • Modificari in registri


Dupa activare, ruleaza un program Windows care afiseaza urmatoarea fereastra:


 Fisiere Se copiaza in urmatoarele locatii:
   • %APPDATA%\hidn\hldrrr.exe
   • %APPDATA%\hidn\hidn2.exe



Se copiaza intr-o arhiva in urmatoarea locatie:
   • C:\temp.zip



Sunt create fisierele:

– Un fisier temporar care poate fi sters dupa aceea:
   • %directorul de activare malware%\aspr_keys.ini

– C:\error.txt Acesta este un fisier text care nu prezinta pericol si are urmatorul continut:
   • UTF-8 decoding error.

– %HOME%\Application Data\hidn\m_hook.sys Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: TR/Rkit.Bagle.GL




Incearca sa descarce cateva fisiere:

– Adresele sunt urmatoarele:
   • http://ujscie.one.pl/**********
   • http://1point2.iae.nl/**********
   • http://appaloosa.no/**********
   • http://apromed.com/**********
   • http://arborfolia.com/**********
   • http://pawlacz.com/**********
   • http://areal-realt.ru/**********
   • http://bitel.ru/**********
   • http://yetii.no-ip.com/**********
   • http://art4u1.superhost.pl/**********
   • http://www.artbed.pl/**********
   • http://art-bizar.foxnet.pl/**********
   • http://www.jonogueira.com/**********
   • http://asdesign.cz/**********
   • http://ftp-dom.earthlink.net/**********
   • http://www.aureaorodeley.com/**********
   • http://www.autoekb.ru/**********
   • http://www.autovorota.ru/**********
   • http://avenue.ee/**********
   • http://ouarzazateservices.com/**********
   • http://stats-adf.altadis.com/**********
   • http://bartex-cit.com.pl/**********
   • http://bazarbekr.sk/**********
   • http://gnu.univ.gda.pl/**********
   • http://bid-usa.com/**********
   • http://biliskov.com/**********
   • http://biomedpel.cz/**********
   • http://blackbull.cz/**********
   • http://bohuminsko.cz/**********
   • http://bonsai-world.com.au/**********
   • http://bpsbillboards.com/**********
   • http://cadinformatics.com/**********
   • http://canecaecia.com/**********
   • http://www.castnetnultimedia.com/**********
   • http://compucel.com/**********
   • http://continentalcarbonindia.com/**********
   • http://ceramax.co.kr/**********
   • http://prime.gushi.org/**********
   • http://www.chapisteriadaniel.com/**********
   • http://charlesspaans.com/**********
   • http://chatsk.wz.cz/**********
   • http://www.chittychat.com/**********
   • http://checkalertusa.com/**********
   • http://cibernegocios.com.ar/**********
   • http://5050clothing.com/**********
   • http://cof666.shockonline.net/**********
   • http://comaxtechnologies.net/**********
   • http://concellodesandias.com/**********
   • http://www.cort.ru/**********
   • http://donchef.com/**********
   • http://www.crfj.com/**********
   • http://kremz.ru/**********
   • http://dev.jintek.com/**********
   • http://foxvcoin.com/**********
   • http://uwua132.org/**********
   • http://v-v-kopretiny.ic.cz/**********
   • http://erich-kaestner-schule-donaueschingen.de/**********
   • http://vanvakfi.com/**********
   • http://axelero.hu/**********
   • http://kisalfold.com/**********
   • http://vega-sps.com/**********
   • http://vidus.ru/**********
   • http://viralstrategies.com/**********
   • http://svatba.viskot.cz/**********
   • http://Vivamodelhobby.com/**********
   • http://vkinfotech.com/**********
   • http://vytukas.com/**********
   • http://waisenhaus-kenya.ch/**********
   • http://watsrisuphan.org/**********
   • http://www.ag.ohio-state.edu/**********
   • http://wbecanada.com/**********
   • http://calamarco.com/**********
   • http://vproinc.com/**********
   • http://grupdogus.de/**********
   • http://knickimbit.de/**********
   • http://dogoodesign.ch/**********
   • http://systemforex.de/**********
   • http://zebrachina.net/**********
   • http://www.walsch.de/**********
   • http://hotchillishop.de/**********
   • http://innovation.ojom.net/**********
   • http://massgroup.de/**********
   • http://web-comp.hu/**********
   • http://webfull.com/**********
   • http://welvo.com/**********
   • http://www.ag.ohio-state.edu/**********
   • http://poliklinika-vajnorska.sk/**********
   • http://wvpilots.org/**********
   • http://www.kersten.de/**********
   • http://www.kljbwadersloh.de/**********
   • http://www.voov.de/**********
   • http://www.wchat.cz/**********
   • http://www.wg-aufbau-bautzen.de/**********
   • http://www.wzhuate.com/**********
   • http://zsnabreznaknm.sk/**********
   • http://xotravel.ru/**********
   • http://ilikesimple.com/**********
   • http://yeniguntugla.com/**********
Fisierul este stocat pe hard disc la: %SYSDIR%\re_file.exe La momentul realizarii descrierii, acest fisier nu era disponibil pentru o analiza ulterioara.

 Registrii sistemului Urmatoarea cheie este adaugata in registri pentru a rula procesul la repornirea sistemului:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • drv_st_key = %APPDATA%\hidn\hidn2.exe



Urmatoarele chei sunt adaugate in registri pentru a incarca serviciul la repornirea sistemului:

– [HKEY_LOCAL-MACHINE\SYSTEM\CurrentControlSet\Services\m_hook]
   • Type = 1
   • Start = 3
   • ErrorControl = 0
   • ImagePath = \??\%APPDATA%\hidn\m_hook.sys
   • DisplayName = Empty



Se sterge urmatoarea cheie din registri, inclusiv toate valorile si cheile subordnate:
   • [HKLM\SYSTEM\CurrentControlSet\Control\Safeboot]



Se adauga in registrii sistemului:

– [HKCU\Software\FirstRuxzx]
   • FirstRu21n = 1

 Email Are un motor SMTP integrat. Va fi facuta o conexiune directa cu serverul destinatar. Iata caracteristicile lui:


De la:
Adresa este falsificata.


Catre:
– Adrese de email gasite pe sistem.
– Urmatoarea adresa de email:
   • user%cateva cifre aleatoare% @gmail.com


Subiect:
Unul din urmatoarele:
   • price_new%data curenta%
   • price_ %data curenta%
   • price%data curenta%
   • price %data curenta%



Corpul email-ului:
– Contine cod HTML.
Corpul email-ului este unul din textele:

   • It Is Protected
     Passwrd: %imagine care contine parola%

   • thank you !!!
     Passwrd: %imagine care contine parola%

   • New year's discounts
     Passwrd: %imagine care contine parola%


Atasament:
Numele fisierului atasat este unul din urmatoarele:
   • price%data curenta%.zip
   • new_price%data curenta%.zip
   • price_list%data curenta%.zip
   • latest_price%data curenta%.zip

Atasamentul este o arhiva ce contine chiar o copie malware.



Email-ul arata astfel:


 Email Cautare adrese:
Cauta adrese de email in urmatoarele fisiere:
   • .wab; .txt; .msg; .htm; .shtm; .stm; .xml; .dbx; .mbx; .mdx; .eml;
      .nch; .mmf; .ods; .cfg; .asp; .php; .pl; .wsh; .adb; .tbb; .sht; .xls;
      .oft; .uin; .cgi; .mht; .dhtm; .jsp


Adrese evitate:
Nu trimite email-uri la adrese care contin unul din urmatoarele siruri de caractere:
   • rating@; f-secur; news; update; anyone@; bugs@; contract@; feste;
      gold-certs@; help@; info@; nobody@; noone@; kasp; admin; icrosoft;
      support; ntivi; unix; bsd; linux; listserv; certific; sopho; @foo;
      @iana; free-av; @messagelab; winzip; google; winrar; samples; abuse;
      panda; cafee; spam; pgp; @avp.; noreply; local; root@; postmaster@


Rezolvarea adreselor internet:
Daca cererea folosind serverul DNS implicit esueaza, efectueaza urmatoarele
Se poate conecta la serverul DNS:
   • 217.5.97.137

 Terminarea proceselor  Lista cu serviciile dezactivate:
   • Aavmker4; ABVPN2K; ADFirewall; AFWMCL; Ahnlab task Scheduler; alerter;
      AlertManger; AntiVir Service; AntiyFirewall; aswMon2; aswRdr; aswTdi;
      aswUpdSv; Ati HotKey Poller; avast! Antivirus; avast! Mail Scanner;
      avast! Web Scanner; AVEService; AVExch32Service; AvFlt; Avg7Alrt;
      Avg7Core; Avg7RsW; Avg7RsXP; Avg7UpdSvc; AvgCore; AvgFsh; AVGFwSrv;
      AvgFwSvr; AvgServ; AvgTdi; AVIRAMailService; AVIRAService; avpcc;
      AVUPDService; AVWUpSrv; AvxIni; awhost32; backweb client - 4476822;
      BackWeb Client - 7681197; backweb client-4476822; Bdfndisf; bdftdif;
      bdss; BlackICE; BsFileSpy; BsFirewall; BsMailProxy; CAISafe; ccEvtMgr;
      ccPwdSvc; ccSetMgr; ccSetMgr.exe; DefWatch; drwebnet; dvpapi; dvpinit;
      ewido security suite control; ewido security suite driver; ewido
      security suite guard; F-Prot Antivirus Update Monitor; F-Secure
      Gatekeeper Handler Starter; firewall; fsbwsys; FSDFWD; FSFW; FSMA;
      FwcAgent; fwdrv; Guard NT; HSnSFW; HSnSPro; InoRPC; InoRT; InoTask;
      Ip6Fw; Ip6FwHlp; KAVMonitorService; KAVSvc; KLBLMain; KPfwSvc;
      KWatch3; KWatchSvc; McAfee Firewall; McAfeeFramework; McShield;
      McTaskManager; mcupdmgr.exe; MCVSRte; Microsoft NetWork FireWall
      Services; MonSvcNT; MpfService; navapsvc; Ndisuio; NDIS_RD; Network
      Associates Log Service; nipsvc; NISSERV; NISUM; NOD32ControlCenter;
      NOD32krn; NOD32Service; Norman NJeeves; Norman Type-R; Norman ZANDA;
      Norton AntiVirus Server; NPDriver; NPFMntor; NProtectService; NSCTOP;
      nvcoas; NVCScheduler; nwclntc; nwclntd; nwclnte; nwclntf; nwclntg;
      nwclnth; NWService; OfcPfwSvc; Outbreak Manager; Outpost Firewall;
      OutpostFirewall; PASSRV; PAVAGENTE; PavAtScheduler; PAVDRV; PAVFIRES;
      PAVFNSVR; Pavkre; PavProc; PavProt; PavPrSrv; PavReport; PAVSRV;
      PCCPFW; PCC_PFW; PersFW; Personal Firewall; PREVSRV; PSIMSVC;
      qhwscsvc; wscsvc; Quick Heal Online Protection; ravmon8; RfwService;
      SAVFMSE; SAVScan; SBService; schscnt; SharedAccess; SmcService;
      SNDSrvc; SPBBCSvc; SpiderNT; SweepNet; Symantec AntiVirus Client;
      Symantec Core LC; The_Hacker_Antivirus; Tmntsrv; TmPfw; tmproxy;
      tmtdi; tm_cfw; T_H_S_M; V3MonNT; V3MonSvc; Vba32ECM; Vba32ifs;
      Vba32Ldr; Vba32PP3; VBCompManService; VexiraAntivirus; VFILT; VisNetic
      AntiVirus Plug-in; vrfwsvc; vsmon; VSSERV; WinAntivirus; WinRoute;
      wuauserv; xcomm

 Backdoor Servere contactate:
Unul dintre:
   • http://www.titanmotors.com/images/1/**********
   • http://veranmaisala.com/1/**********
   • http://wklight.nazwa.pl/1/**********
   • http://yongsan24.co.kr/1/**********
   • http://accesible.cl/1/**********
   • http://hotelesalba.com/1/**********
   • http://amdlady.com/1/**********
   • http://inca.dnetsolution.net/1/**********
   • http://www.auraura.com/1/**********
   • http://avataresgratis.com/1/**********
   • http://beyoglu.com.tr/1/**********
   • http://brandshock.com/1/**********
   • http://www.buydigital.co.kr/1/**********
   • http://camaramafra.sc.gov.br/1/**********
   • http://camposequipamentos.com.br/1/**********
   • http://cbradio.sos.pl/1/**********
   • http://c-d-c.com.au/1/**********
   • http://www.klanpl.com/1/**********
   • http://coparefrescos.stantonstreetgroup.com/1/**********
   • http://creainspire.com/1/**********
   • http://desenjoi.com.br/1/**********
   • http://www.inprofile.gr/1/**********
   • http://www.diem.cl/1/**********
   • http://www.discotecapuzzle.com/1/**********


 Tehnologie Rootkit  Este o tehnologie specifica malware. Acesta se ascunde de programele sistemului, de aplicatiile de securitate si in cele din urma, de utilizator.


Ascunde urmatoarele:
– Propriile fisiere
– Propriul proces
– Propriile chei de registru


Metoda folosita:
    • Ascuns de Windows API

 Detaliile fisierului Limbaj de programare:
 Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).


Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit urmatorul program de arhivare:
   • ASProtect

Descrizione inserita da Alexander Vukcevic su venerdì 1 dicembre 2006
Descrizione aggiornata da Andrei Gherman su lunedì 4 dicembre 2006

Indietro . . . .