Worm/Bagle.FK - Worm

In alte limbi

Scurta descriere

Descriere completa

Statistici

Nume:	Worm/Bagle.FK
Descoperit pe data de:	09/02/2006
Tip:	Vierme
ITW:	Da
Numar infectii raportate:	Scazut
Potential de raspandire:	Mediu spre ridicat
Potential de distrugere:	Scazut
Fisier static:	Nu
Marime:	~ 26.000 Bytes
Versiune VDF:	6.33.00.215

General Metoda de raspandire:
   • Email
   • Peer to Peer

Alias:
   • Bitdefender: Trojan.Downloader.Bagle.EO

Sistem de operare:
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Creeaza fisiere malware
   • Utilizeaza propriul motor de email
   • Modificari in registri

Imediat dupa lansarea in executie, pe ecran este afisat:

Fisiere Se copiaza in urmatoarea locatie:
   • %SYSDIR%\regmaping.exe

Se copiaza in urmatoarele locatii (fisierele au atasate la sfarsit caractere aleatorii si se diferentiaza astfel de original):
   • %SYSDIR%\regmaping.exeopen
   • %SYSDIR%\regmaping.exeopenopen

Este creat fisierul:

– %WINDIR%\winresw.exe Fisierul este executat dupa ce a fost creat. Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: Worm/Bagle.FJ.2

Registrii sistemului Urmatoarea cheie este adaugata in registri pentru a rula procesul la repornirea sistemului:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Regmonitor"="%SYSDIR%\regmaping.exe"

Valorile urmatoarelor chei sunt sterse din registrii sistemului:

– [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • 9XHtProtect
   • Antivirus
   • EasyAV
   • FirewallSvr
   • HtProtect
   • ICQ Net
   • ICQNet
   • Jammer2nd
   • KasperskyAVEng
   • MsInfo
   • My AV
   • NetDy
   • Norton Antivirus AV
   • PandaAVEngine
   • service
   • SkynetsRevenge
   • Special Firewall Service
   • SysMonXP
   • Tiny AV
   • Zone Labs Client Ex

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • 9XHtProtect
   • Antivirus
   • EasyAV
   • FirewallSvr
   • HtProtect
   • ICQ Net
   • ICQNet
   • Jammer2nd
   • KasperskyAVEng
   • MsInfo
   • My AV
   • NetDy
   • Norton Antivirus AV
   • PandaAVEngine
   • service
   • SkynetsRevenge
   • Special Firewall Service
   • SysMonXP
   • Tiny AV
   • Zone Labs Client Ex

Email Are un motor SMTP integrat. Va fi facuta o conexiune directa cu serverul destinatar. Iata caracteristicile lui:

Catre:
– Adrese de email gasite pe sistem.

Subiect:
Unul din urmatoarele:
   • Your Receipt %cateva numere aleatoare de la 0 la 9%
   • Billing department, order %cateva numere aleatoare de la 0 la 9%
   • Order reminder: ID %cateva numere aleatoare de la 0 la 9%

Corpul email-ului:
Corpul email-ului este unul din textele:

   • ******************************************************************

     Details about your reciept attached with this email. You have to use Adobe Acrobat Reader to open it.

     Transaction Number: %cateva numere aleatoare de la 0 la 9%
     This is your receipt for your $1490 purchase of a 1.0 months
     subscription which will appear on your statement as %cateva numere aleatoare de la 0 la 9%.
     Your membership will automatically renew per the terms and conditions.

     Should you ever have any
     problems whatsoever, please don't hesitate to contact our live technical support staff - available 24 hours a day 7 days a week. We can be reached by phone toll free in the US at 800-534-8593. Rather use email?
     Drop us a line at bill@gmail.com and we'll always get back to you within an hour.

     Enjoy the service?
     Support

     ******************************************************************

   • Your email %adresa destinatarului% has exceeded its
bandwidth quota in the period beginning on 2006-01-01.
Your quota is set to 10485760 bytes (10.0 MB), and
your email has consumed 559189702 bytes (533.285 MB) beyond that quota.

Our over-bandwidth charges are
Additional Bandwidth/Month Monthly Cost
100 Mb $200.00
200 MB $360.00
300 MB $480.00
400 MB $624.00
500 Mb $740.00 <- your over-usage
600 Mb $850.00

Our automatically generated bill is attached with this email.

Sincerely,
Sales Manager.



   • Dear Sir or Madam,

     This notification is just a friendly reminder (not a bill or a second charge) that on 15-JAN-06, you placed an order from Symantec Store. This order was paid using your Visa, whose last 4 digits are ************2346, and will be appearing on your billing statement shortly. The charge will appear as DR *Symantec. This is just a reminder to help you recognize the charge. You will not be charged again.
     You antivirus definition file is attached to this email, please install it to be perfectly protected from the latest viruses and other internet threats.

Atasament:
Numele fisierului atasat este unul din urmatoarele:
   • Order_details.exe
   • Service_receipt.exe
   • Generated_bill.exe

Atasamentul este o copie malware.

Email Cautare adrese:
Cauta adrese de email in urmatoarele fisiere:
   • .wab; .txt; .msg; .htm; .shtm; .stm; .xml; .dbx; .mbx; .mdx; .eml;
      .nch; .mmf; .ods; .cfg; .asp; .php; .wsh; .adb; .tbb; .sht; .xls;
      .oft; .uin; .cgi; .mht; .dhtm; .jsp

Adrese evitate:
Nu trimite email-uri la adrese care contin unul din urmatoarele siruri de caractere:
   • @hotmail; @msn; @microsoft; rating@; f-secur; news; update; anyone@;
      bugs@; contract@; feste; gold-certs@; help@; info@; nobody@; noone@;
      kasp; admin; icrosoft; support; ntivi; unix; bsd; linux; listserv;
      certific; sopho; @foo; @iana; free-av; @messagelab; winzip; google;
      winrar; samples; abuse; panda; cafee; spam; pgp; @avp.; noreply;
      local; root@; postmaster@

P2P Pentru a infecta alte sisteme din retele Peer-to-Peer, efectueaza urmatarele operatii:   Cauta directoarele care au in numele lor textul:
   • shar

   Daca reuseste, sunt create urmatoarele fisiere:
   • Adobe Photoshop 9 full.exe; Ahead Nero 10.exe; anna benson sex
      video.exe; barrett jackson nude photos, movies, porn video.exe;
      Britney Spears sex photos.exe; IE beta 7.exe; jenna elfman sex anal
      deepthroat; kate beckinsale nude pictures.exe; miss america Porno,
      sex, oral, anal cool, awesome!!.exe; paris hilton Porno pics arhive,
      xxx.exe; Porno Screensaver.scr; Serials 2005 database.exe;
      Serials.txt.exe; Windown Vista Beta Leak.exe; Windows Sourcecode
      update.doc.exe; XXX hardcore images.exe

   Aceste fişiere sunt copii ale malware-ului.

Backdoor Deschide portul

– %SYSDIR%\regmaping.exe pe portul TCP 6777

Servere contactate:
Urmatorul:
• http://ijj.t**********

Astfel se pot transmite informatii.

Trimte informatii despre:
• Statusul actual al malware-ului

Alte informatii Mutex:
Creeaza urmatorii mutecsi:
   • MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D
   • 'D'r'o'p'p'e'd'S'k'y'N'e't'
   • _-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
   • [SkyNet.cz]SystemsMutex
   • AdmSkynetJklS003
   • ____--->>>>U<<<<--____
   • _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_
   • smtp_bagla_1000

Sir de caractere:
In plus, mai contine urmatorul sir de caractere:
   • In a difficult world
In a nameless time
I want to survive
So, you will be mine!!
-- Bagle Author, 29.04.04, Germany.

Detaliile fisierului Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit urmatorul program de arhivare:
• UPX

Pentru o descriere scurta click aici.

Descriere introdusa de Andrei Ivanes la Thu, 09 Feb 2006 14:59 (GMT+1)
Descriere actualizata de Andrei Ivanes la Fri, 10 Feb 2006 10:35 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back