Installation to system
When the worm's file is run, it copies itself as 'svc23.exe'
to Windows System folder. It installs the following registry key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ru1n]
"erthgdr2" = "%Sysdir%\svc23.exe"
%SysDir% represents the Windows System folder name, for example
C:\Windows\System32 on Windows XP systems.
Email Propagation
Bagle.CI gathers email-addresses from web servers. The servers host
a PHP script that generates dynamically seemingly random list of
e-mail addresses. The servers are polled periodically and the returned
file is saved as 'eml.exe' in the Windows folder. At the time of this
writing, some of the servers are functional.
Here's the list of servers that host the PHP script:
amerikansk-bulldog.dk
carnwoodcontracting.com
clickhare.com
cptna.com
creacionesartisticasandaluzas.com
dggraphicsonline.com
directeenhuis.nl
doelker-torbau.de
dorelvis.com
downwiththesickness.com
dreamdecor.com.pl
dunajec.zakliczyn.pnth.net
ekshrine.com
essonline.us
eventpeopleforyou.com
falconframingco.com
familiasmaltratadas.com
fiberdesign.co.uk
fiberfeed.com
findingmodels.net
fpcoc.org
fyeye.com
gamespy.cz
golosmira.com
goto.mk.ua
ligapichangueras.cl
phdenmark.dk
representacion4380.net
The worm ignores e-mail addresses that contain any of the following
strings:
abuse
admin
anyone@
@avp.
bsd
bugs@
cafee
certific
contract@
@derewrdgrs
@eerswqe
feste
@foo
free-av
f-secur
gold-certs@
google
help@
@iana
icrosoft
info@
kasp
linux
listserv
local
@messagelab
@microsoft
news
nobody@
noone@
noreply
ntivi
panda
pgp
postmaster@
rating@
root@
samples
sopho
spam
support
unix
update
winrar
winzip
