- It does not send .HTA or .VBS attachments anymore
- It has a downloader feature that attempts to download and run a file
from several web pages
Detailed Description
The worm is a PE executable about 20 kilobytes long. The worm's
file is packed with UPX file compressor. Additionally the worm
uses encryption of its code and data areas and adds random
garbage to the end of its file as a decoy. The worm can also
spread with a prepended Windows Control Panel Applet (CPL) stub
(see info below).
If system date is May 5th, 2006 the worm uninstalls
itself from an infected system by deleting its startup key
in the Registry and terminating its own process.
When active in memory, the worm re-creates its startup key
every 100 milliseconds.
System Infection
When the worm's file is run, it copies itself as SYSXP.EXE file
to Windows System folder and creates a startup key for this file
in the Registry:
The worm ignores e-mail addresses that contain the following
strings:
@hotmail
@msn
@microsoft
rating@
f-secur
news
update
anyone@
bugs@
contract@
feste
gold-certs@
help@
info@
nobody@
noone@
kasp
admin
icrosoft
support
ntivi
unix
bsd
linux
listserv
certific
sopho
@foo
@iana
free-av
@messagelab
winzip
google
winrar
samples
abuse
panda
cafee
spam
pgp
@avp.
noreply
local
root@
postmaster@
The worm spreads itself in e-mails with different subject texts
and attachment names. The worm can attach itself to e-mails as an
executable file with COM, EXE, SCR and CPL extension,
as a ZIP archive (password-protected).
When spreading as a Windows Control Panel Applet (CPL) file, the
worm prepends a small binary
dropper to its executable file. When the CPL file is activated,
it copies itself as CJECTOR.EXE file to Windows folder and then
drops the worm's file into Windows System folder.
Bagle.Z uses the following text strings as subjects for infected
e-mails that it sends:
When the worm sends itself in a password-protected file, it puts
one of the following strings in the message's body:
For security reasons attached file is password protected. The password is <password>
For security purposes the attached file is password protected. Password -- <password>
Note: Use password <password> to open archive
Attached file is protected with the password for security reasons. Password is <password>
In order to read the attach you have to use the following password: <password>
Archive password: <password>
Password - <password>
Password: <password>
where <password> is an image with a password for the worm's
archive. Sometimes the worms sends a password for its archive as
an ASCII text. In some cases the whole password information can
be sent as an image, for example:
The worm uses the following attachment names:
Information
Details
text_document
Updates
Readme
Document
Info
Details
Message
Backdoor
The worm has a backdoor that listens to port 1080. The backdoor
code is encrypted with a password. The worm author who knows the
password can connect to the computer and execute arbitrary programs.
Propagation Through Shared Folders
The worm is capable of spreading to shared folders. It scans all
available drives and if it finds a folder name that contains
'shar' substring, the worm copies itself there with the following
names:
Microsoft Office 2003 Crack, Working!.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Microsoft Office XP working Crack, Keygen.exe
Porno, sex, oral, anal cool, awesome!!.exe
Porno Screensaver.scr
Serials.txt.exe
KAV 5.0
Kaspersky Antivirus 5.0
Porno pics arhive, xxx.exe
Windows Sourcecode update.doc.exe
Ahead Nero 7.exe
Windown Longhorn Beta Leak.exe
Opera 8 New!.exe
XXX hardcore images.exe
WinAmp 6 New!.exe
WinAmp 5 Pro Keygen Crack Update.exe
Adobe Photoshop 9 full.exe
Matrix 3 Revolution English Subtitles.exe
ACDSee 9.exe
This method allows the worm to spread to shared folders if P2P
(peer-to-peer) clients and to shared network folders.
Terminating Security Software
Bagle.AF terminates processes of security and anti-virus software
as well as some other applications. Processes of the following
applications are terminated:
This variant of Bagle removes the following Netsky worm startup
keys:
My AV
Zone Labs Client Ex
9XHtProtect
Antivirus
Special Firewall Service
service
Tiny AV
ICQNet
HtProtect
NetDy
Jammer2nd
FirewallSvr
MsInfo
SysMonXP
EasyAV
PandaAVEngine
Norton Antivirus AV
KasperskyAVEng
SkynetsRevenge
ICQ Net
Additionally the worm creates several mutexes with names that
are used by Netsky worm. So certain versions of Netsky will
not infect a system where Bagle.AF worm is active.
![](/images/pixel.gif"){kind=tracking}
