|
|
|  |
|
|
|
|
F-Secure Virus Information Pages: Bagle.Q
|
|
|
| Radar Alert |
 |
| Level 2 |
|
|
|
Summary
|
A new Bagle variant - Bagle.Q was found on March 18th, 2004. Shortly after
it, three similar variants were found as well. Further information about
these variants is available at:
http://www.f-secure.com/v-descs/bagle_r.shtml
http://www.f-secure.com/v-descs/bagle_s.shtml
http://www.f-secure.com/v-descs/bagle_t.shtml
Bagle.Q also parasitically infects EXE files.
When Bagle.Q copies itself to the system (as DIRECTS.EXE), it uses an icon which
looks fairly innocent...
Do note that this email worm does not send itself as an email attachment at all.
|
|
|
|
Detailed Description
|
System Infection
Upon execution the worm copies itself to to the Windows System directory as 'direct.exe' and creates a startup key for this file in the Registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"direct.exe" = "%SysDir%\direct.exe"
where %SysDir% represents Windows System directory name.
The following registry value is removed:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"My AV"
Email Propagation
Bagle.Q recursively searches through all hard drives to locate files which might contain email addresses. All files with the following extensions are checked:
- .wab
- .txt
- .msg
- .htm
- .shtm
- .stm
- .xml
- .dbx
- .mbx
- .mdx
- .eml
- .nch
- .mmf
- .ods
- .cfg
- .asp
- .php
- .wsh
- .adb
- .tbb
- .sht
- .xls
- .oft
- .uin
- .cgi
- .mht
- .dhtm
- .jsp
This email worm is different from the previous Bagle variants because it attempts to move the infected file to new hosts by downloading it from a web server it installs to hosts it previously infected.
The email contains an exploit that downloads and executes a script with '.php' extension from the web. Further information about this vulnerability,
known as Internet Explorer Object Data Remote Execution, is available from Microsoft:
http://www.microsoft.com/technet/security/bulletin/MS03-032.mspx
The script is downloaded using a predefined list of servers. This script, which is actually written in Visual Basic Script, drops another script, 'q.vbs', on the system. This script then downloads the worm itself in a file that has '.jpeg' extension as 'sm.exe' and executes it.
The emails have spoofed sender address and subjects randomly chosen from the following list:
- Re: Msg reply
- Re: Hello
- Re: Yahoo!
- Re: Thank you!
- Re: Thanks :)
- RE: Text message
- Re: Document
- Incoming message
- Re: Incoming Message
- Re: Incoming Fax
- Hidden message
- Fax Message Received
- Protected message
- RE: Protected message
- Forum notify
- Request response
- Site changes
- Re: Hi
- Encrypted document
There is no attachment in the email.
The worm does not send emails to addresses that contains any of the following strings:
- @hotmail
- @msn
- @microsoft
- rating@
- f-secur
- anyone@
- bugs@
- contract@
- feste
- gold-certs@
- help@
- info@
- nobody@
- noone@
- kasp
- admin
- icrosoft
- support
- ntivi
- unix
- linux
- listserv
- certific
- sopho
- @foo
- @iana
- free-av
- @messagelab
- winzip
- google
- winrar
- samples
- support
- ntivi
- unix
- linux
- listserv
- certific
- sopho
- @foo
- @iana
- free-av
- @messagelab
- winzip
- google
- winrar
- samples
- abuse
- panda
- cafee
- spam
- @avp.
- noreply
- local
- root@
- postmaster@
Termination of Security Software
One of the payloads of Bagle.Q is a routine that finds and terminates several processes related to different security software packages and tools that could help the user to find the infection:
- CLEANER3.EXE
- au.exe
- d3dupdate.exe
- CLEANPC.EXE
- AVprotect9x.exe
- CMGRDIAN.EXE
- CMON016.EXE
- CPF9X206.EXE
- CPFNT206.EXE
- CV.EXE
- CWNB181.EXE
- CWNTDWMO.EXE
- ICSSUPPNT.EXE
- DEFWATCH.EXE
- DEPUTY.EXE
- DPF.EXE
- DPFSETUP.EXE
- DRWATSON.EXE
- ENT.EXE
- ESCANH95.EXE
- AVXQUAR.EXE
- ESCANHNT.EXE
- ESCANV95.EXE
- AVPUPD.EXE
- EXANTIVIRUS-CNET.EXE
- FAST.EXE
- FIREWALL.EXE
- FLOWPROTECTOR.EXE
- FP-WIN_TRIAL.EXE
- FRW.EXE
- FSAV.EXE
- AUTODOWN.EXE
- DRWATSON.EXE
- ENT.EXE
- ESCANH95.EXE
- AVXQUAR.EXE
- ESCANHNT.EXE
- ESCANV95.EXE
- AVPUPD.EXE
- EXANTIVIRUS-CNET.EXE
- FAST.EXE
- FIREWALL.EXE
- FLOWPROTECTOR.EXE
- FP-WIN_TRIAL.EXE
- FRW.EXE
- FSAV.EXE
- AUTODOWN.EXE
- FSAV530STBYB.EXE
- FSAV530WTBYB.EXE
- FSAV95.EXE
- GBMENU.EXE
- GBPOLL.EXE
- GUARD.EXE
- GUARDDOG.EXE
- HACKTRACERSETUP.EXE
- HTLOG.EXE
- HWPE.EXE
- IAMAPP.EXE
- IAMAPP.EXE
- IAMSERV.EXE
- ICLOAD95.EXE
- ICLOADNT.EXE
- ICMON.EXE
- ICSUPP95.EXE
- FSAV95.EXE
- GBMENU.EXE
- GBPOLL.EXE
- GUARD.EXE
- GUARDDOG.EXE
- HACKTRACERSETUP.EXE
- HTLOG.EXE
- HWPE.EXE
- IAMAPP.EXE
- IAMAPP.EXE
- IAMSERV.EXE
- ICLOAD95.EXE
- ICLOADNT.EXE
- ICMON.EXE
- ICSUPP95.EXE
- ICSUPPNT.EXE
- IFW2000.EXE
- IPARMOR.EXE
- IRIS.EXE
- JAMMER.EXE
- ATUPDATER.EXE
- AUPDATE.EXE
- KAVLITE40ENG.EXE
- KAVPERS40ENG.EXE
- KERIO-PF-213-EN-WIN.EXE
- KERIO-WRL-421-EN-WIN.EXE
- BORG2.EXE
- BS120.EXE
- CDP.EXE
- CFGWIZ.EXE
- CFIADMIN.EXE
- CFIAUDIT.EXE
- IPARMOR.EXE
- IRIS.EXE
- JAMMER.EXE
- ATUPDATER.EXE
- AUPDATE.EXE
- KAVLITE40ENG.EXE
- KAVPERS40ENG.EXE
- KERIO-PF-213-EN-WIN.EXE
- KERIO-WRL-421-EN-WIN.EXE
- BORG2.EXE
- BS120.EXE
- CDP.EXE
- CFGWIZ.EXE
- CFIADMIN.EXE
- CFIAUDIT.EXE
- AUTOUPDATE.EXE
- CFINET.EXE
- NAVAPW32.EXE
- NAVDX.EXE
- NAVSTUB.EXE
- NAVW32.EXE
- NC2000.EXE
- NCINST4.EXE
- AUTOTRACE.EXE
- NDD32.EXE
- NEOMONITOR.EXE
- NETARMOR.EXE
- NETINFO.EXE
- NETMON.EXE
- NETSCANPRO.EXE
- NETSPYHUNTER-1.2.EXE
- NETSTAT.EXE
- NAVAPW32.EXE
- NAVDX.EXE
- NAVSTUB.EXE
- NAVW32.EXE
- NC2000.EXE
- NCINST4.EXE
- AUTOTRACE.EXE
- NDD32.EXE
- NEOMONITOR.EXE
- NETARMOR.EXE
- NETINFO.EXE
- NETMON.EXE
- NETSCANPRO.EXE
- NETSPYHUNTER-1.2.EXE
- NETSTAT.EXE
- NISSERV.EXE
- NISUM.EXE
- NMAIN.EXE
- NORTON_INTERNET_SECU_3.0_407.EXE
- NPF40_TW_98_NT_ME_2K.EXE
- NPFMESSENGER.EXE
- NPROTECT.EXE
- NSCHED32.EXE
- NTVDM.EXE
- NVARCH16.EXE
- KERIO-WRP-421-EN-WIN.EXE
- KILLPROCESSSETUP161.EXE
- LDPRO.EXE
- LOCALNET.EXE
- LOCKDOWN.EXE
- LOCKDOWN2000.EXE
- LSETUP.EXE
- NMAIN.EXE
- NORTON_INTERNET_SECU_3.0_407.EXE
- NPF40_TW_98_NT_ME_2K.EXE
- NPFMESSENGER.EXE
- NPROTECT.EXE
- NSCHED32.EXE
- NTVDM.EXE
- NVARCH16.EXE
- KERIO-WRP-421-EN-WIN.EXE
- KILLPROCESSSETUP161.EXE
- LDPRO.EXE
- LOCALNET.EXE
- LOCKDOWN.EXE
- LOCKDOWN2000.EXE
- LSETUP.EXE
- OUTPOST.EXE
- CFIAUDIT.EXE
- LUCOMSERVER.EXE
- AGENTSVR.EXE
- ANTI-TROJAN.EXE
- ANTI-TROJAN.EXE
- ANTIVIRUS.EXE
- ANTS.EXE
- APIMONITOR.EXE
- APLICA32.EXE
- APVXDWIN.EXE
- ATCON.EXE
- ATGUARD.EXE
- ATRO55EN.EXE
- ATWATCH.EXE
- AVCONSOL.EXE
- AVGSERV9.EXE
- LUCOMSERVER.EXE
- AGENTSVR.EXE
- ANTI-TROJAN.EXE
- ANTI-TROJAN.EXE
- ANTIVIRUS.EXE
- ANTS.EXE
- APIMONITOR.EXE
- APLICA32.EXE
- APVXDWIN.EXE
- ATCON.EXE
- ATGUARD.EXE
- ATRO55EN.EXE
- ATWATCH.EXE
- AVCONSOL.EXE
- AVGSERV9.EXE
- AVSYNMGR.EXE
- BD_PROFESSIONAL.EXE
- BIDEF.EXE
- BIDSERVER.EXE
- BIPCP.EXE
- BIPCPEVALSETUP.EXE
- BISP.EXE
- BLACKD.EXE
- BLACKICE.EXE
- BOOTWARN.EXE
- NWINST4.EXE
- NWTOOL16.EXE
- OSTRONET.EXE
- OUTPOSTINSTALL.EXE
- OUTPOSTPROINSTALL.EXE
- PADMIN.EXE
- PANIXK.EXE
- BIDEF.EXE
- BIDSERVER.EXE
- BIPCP.EXE
- BIPCPEVALSETUP.EXE
- BISP.EXE
- BLACKD.EXE
- BLACKICE.EXE
- BOOTWARN.EXE
- NWINST4.EXE
- NWTOOL16.EXE
- OSTRONET.EXE
- OUTPOSTINSTALL.EXE
- OUTPOSTPROINSTALL.EXE
- PADMIN.EXE
- PANIXK.EXE
- PAVPROXY.EXE
- DRWEBUPW.EXE
- PCC2002S902.EXE
- PCC2K_76_1436.EXE
- PCCIOMON.EXE
- PCDSETUP.EXE
- PCFWALLICON.EXE
- PCFWALLICON.EXE
- PCIP10117_0.EXE
- PDSETUP.EXE
- PERISCOPE.EXE
- PERSFW.EXE
- PF2.EXE
- AVLTMAIN.EXE
- PFWADMIN.EXE
- PINGSCAN.EXE
- PLATIN.EXE
- PCC2002S902.EXE
- PCC2K_76_1436.EXE
- PCCIOMON.EXE
- PCDSETUP.EXE
- PCFWALLICON.EXE
- PCFWALLICON.EXE
- PCIP10117_0.EXE
- PDSETUP.EXE
- PERISCOPE.EXE
- PERSFW.EXE
- PF2.EXE
- AVLTMAIN.EXE
- PFWADMIN.EXE
- PINGSCAN.EXE
- PLATIN.EXE
- POPROXY.EXE
- POPSCAN.EXE
- PORTDETECTIVE.EXE
- PPINUPDT.EXE
- PPTBC.EXE
- PPVSTOP.EXE
- PROCEXPLORERV1.0.EXE
- PROPORT.EXE
- PROTECTX.EXE
- PSPF.EXE
- WGFE95.EXE
- WHOSWATCHINGME.EXE
- AVWUPD32.EXE
- NUPGRADE.EXE
- WHOSWATCHINGME.EXE
- WINRECON.EXE
- WNT.EXE
- PORTDETECTIVE.EXE
- PPINUPDT.EXE
- PPTBC.EXE
- PPVSTOP.EXE
- PROCEXPLORERV1.0.EXE
- PROPORT.EXE
- PROTECTX.EXE
- PSPF.EXE
- WGFE95.EXE
- WHOSWATCHINGME.EXE
- AVWUPD32.EXE
- NUPGRADE.EXE
- WHOSWATCHINGME.EXE
- WINRECON.EXE
- WNT.EXE
- WRADMIN.EXE
- WRCTRL.EXE
- WSBGATE.EXE
- WYVERNWORKSFIREWALL.EXE
- XPF202EN.EXE
- ZAPRO.EXE
- ZAPSETUP3001.EXE
- ZATUTOR.EXE
- CFINET32.EXE
- CLEAN.EXE
- CLEANER.EXE
- CLEANER3.EXE
- CLEANPC.EXE
- CMGRDIAN.EXE
- CMON016.EXE
- CPD.EXE
- CFGWIZ.EXE
- WSBGATE.EXE
- WYVERNWORKSFIREWALL.EXE
- XPF202EN.EXE
- ZAPRO.EXE
- ZAPSETUP3001.EXE
- ZATUTOR.EXE
- CFINET32.EXE
- CLEAN.EXE
- CLEANER.EXE
- CLEANER3.EXE
- CLEANPC.EXE
- CMGRDIAN.EXE
- CMON016.EXE
- CPD.EXE
- CFGWIZ.EXE
- CFIADMIN.EXE
- PURGE.EXE
- PVIEW95.EXE
- QCONSOLE.EXE
- QSERVER.EXE
- RAV8WIN32ENG.EXE
- REGEDT32.EXE
- REGEDIT.EXE
- UPDATE.EXE
- RESCUE.EXE
- RESCUE32.EXE
- RRGUARD.EXE
- RSHELL.EXE
- RTVSCN95.EXE
- RULAUNCH.EXE
- SAFEWEB.EXE
- SBSERV.EXE
- PVIEW95.EXE
- QCONSOLE.EXE
- QSERVER.EXE
- RAV8WIN32ENG.EXE
- REGEDT32.EXE
- REGEDIT.EXE
- UPDATE.EXE
- RESCUE.EXE
- RESCUE32.EXE
- RRGUARD.EXE
- RSHELL.EXE
- RTVSCN95.EXE
- RULAUNCH.EXE
- SAFEWEB.EXE
- SBSERV.EXE
- SD.EXE
- SETUP_FLOWPROTECTOR_US.EXE
- SETUPVAMEEVAL.EXE
- SFC.EXE
- SGSSFW32.EXE
- SH.EXE
- SHELLSPYINSTALL.EXE
- SHN.EXE
- SMC.EXE
- SOFI.EXE
- SPF.EXE
- SPHINX.EXE
- SPYXX.EXE
- SS3EDIT.EXE
- ST2.EXE
- SUPFTRL.EXE
- LUALL.EXE
- SETUPVAMEEVAL.EXE
- SFC.EXE
- SGSSFW32.EXE
- SH.EXE
- SHELLSPYINSTALL.EXE
- SHN.EXE
- SMC.EXE
- SOFI.EXE
- SPF.EXE
- SPHINX.EXE
- SPYXX.EXE
- SS3EDIT.EXE
- ST2.EXE
- SUPFTRL.EXE
- LUALL.EXE
- SUPPORTER5.EXE
- SYMPROXYSVC.EXE
- SYSEDIT.EXE
- TASKMON.EXE
- TAUMON.EXE
- TAUSCAN.EXE
- TC.EXE
- TCA.EXE
- TCM.EXE
- TDS2-98.EXE
- TDS2-NT.EXE
- TDS-3.EXE
- TFAK5.EXE
- TGBOB.EXE
- TITANIN.EXE
- TITANINXP.EXE
- TRACERT.EXE
- SYSEDIT.EXE
- TASKMON.EXE
- TAUMON.EXE
- TAUSCAN.EXE
- TC.EXE
- TCA.EXE
- TCM.EXE
- TDS2-98.EXE
- TDS2-NT.EXE
- TDS-3.EXE
- TFAK5.EXE
- TGBOB.EXE
- TITANIN.EXE
- TITANINXP.EXE
- TRACERT.EXE
- TRJSCAN.EXE
- TRJSETUP.EXE
- TROJANTRAP3.EXE
- UNDOBOOT.EXE
- VBCMSERV.EXE
- VBCONS.EXE
- VBUST.EXE
- VBWIN9X.EXE
- VBWINNTW.EXE
- VCSETUP.EXE
- VFSETUP.EXE
- VIRUSMDPERSONALFIREWALL.EXE
- VNLAN300.EXE
- VNPC3000.EXE
- VPC42.EXE
- VPFW30S.EXE
- VPTRAY.EXE
- TROJANTRAP3.EXE
- UNDOBOOT.EXE
- VBCMSERV.EXE
- VBCONS.EXE
- VBUST.EXE
- VBWIN9X.EXE
- VBWINNTW.EXE
- VCSETUP.EXE
- VFSETUP.EXE
- VIRUSMDPERSONALFIREWALL.EXE
- VNLAN300.EXE
- VNPC3000.EXE
- VPC42.EXE
- VPFW30S.EXE
- VPTRAY.EXE
- VSCENU6.02D30.EXE
- VSECOMR.EXE
- VSHWIN32.EXE
- VSISETUP.EXE
- VSMAIN.EXE
- VSMON.EXE
- VSSTAT.EXE
- VSWIN9XE.EXE
- VSWINNTSE.EXE
- VSWINPERSE.EXE
- W32DSM89.EXE
- W9X.EXE
- WATCHDOG.EXE
- WEBSCANX.EXE
- CFIAUDIT.EXE
- CFINET.EXE
- ICSUPP95.EXE
- VSHWIN32.EXE
- VSISETUP.EXE
- VSMAIN.EXE
- VSMON.EXE
- VSSTAT.EXE
- VSWIN9XE.EXE
- VSWINNTSE.EXE
- VSWINPERSE.EXE
- W32DSM89.EXE
- W9X.EXE
- WATCHDOG.EXE
- WEBSCANX.EXE
- CFIAUDIT.EXE
- CFINET.EXE
- ICSUPP95.EXE
- MCUPDATE.EXE
- CFINET32.EXE
- CLEAN.EXE
- CLEANER.EXE
- LUINIT.EXE
- MCAGENT.EXE
- MCUPDATE.EXE
- MFW2EN.EXE
- MFWENG3.02D30.EXE
- MGUI.EXE
- MINILOG.EXE
- MOOLIVE.EXE
- MRFLUX.EXE
- MSCONFIG.EXE
- MSINFO32.EXE
- MSSMMC32.EXE
- MU0311AD.EXE
- CLEAN.EXE
- CLEANER.EXE
- LUINIT.EXE
- MCAGENT.EXE
- MCUPDATE.EXE
- MFW2EN.EXE
- MFWENG3.02D30.EXE
- MGUI.EXE
- MINILOG.EXE
- MOOLIVE.EXE
- MRFLUX.EXE
- MSCONFIG.EXE
- MSINFO32.EXE
- MSSMMC32.EXE
- MU0311AD.EXE
- NAV80TRY.EXE
- ZAUINST.EXE
- ZONALM2601.EXE
- ZONEALARM.EXE
Backdoor
The backdoor of Bagle.Q listens on TCP port 2556 and is similar to the one in previous variants of bagle. It gives the attacker full
control over the compromised computer.
Web Server
Bagle.Q introduces a simple, stripped-down webserver listening on TCP port 81 that serves the PHP and JPEG files needed by the exploit. The server does not serve any other file.
Peer-to-Peer
The worm also affects Peer-to-Peer applications. It copies itself to any directory that contains the substring 'shar'. Directories of P2P applications typically have this in the directory names.
When poisoning P2P directories the Bagle.Q uses different names that might catch downloaders' eyes:
- Microsoft Office 2003 Crack, Working!.exe
- Microsoft Windows XP, WinXP Crack, working Keygen.exe
- Microsoft Office XP working Crack, Keygen.exe
- Porno, sex, oral, anal cool, awesome!!.exe
- Porno Screensaver.scr
- Serials.txt.exe
- Porno pics arhive, xxx.exe
- Windows Sourcecode update.doc.exe
- Ahead Nero 7.exe
- Windown Longhorn Beta Leak.exe
- Opera 8 New!.exe
- XXX hardcore images.exe
- WinAmp 6 New!.exe
- WinAmp 5 Pro Keygen Crack Update.exe
- Adobe Photoshop 9 full.exe
- Matrix 3 Revolution English Subtitles.exe
- ACDSee 9.exe
|
|
|
|
F-Secure Corporation |
|
|
|
|
|
Last Modified: January 01, 2006
|
|
|
|
|
