Name :	Trojan:W32/Bagle.GF
Detection Names :	W32/Bagle.GF Email-Worm.Win32.Bagle.gf, Trojan-Downloader.Win32.Bagle.gf
Category:	Malware
Type:	Trojan
Platform:	W32
Date of Discovery:	February 13, 2006

A trojan, or trojan horse, is a seemingly legitimate program which secretly performs other, usually malicious, functions. It is usually user-initiated and does not replicate.

For removal instructions specific to Bagle infections, see Email-Worm:W32/Bagle.

For more general information on disinfection, please see Removal Instructions.

Trojan:W32/Bagle.GF sets up a proxy service on the infected machine. Through the proxy, Bagle authors can send spam or access other network resources.

This Bagle related malware was found on the 23rd of March 2006.


Installation

When the trojan file is run, it copies itself as:


%System% represents the Windows System folder.

The trojan installs the following registry launchpoint as a string value:


The trojan uses a named mutex "555" for ensuring that only one copy of the trojan is run at the same time.


Payload

The main payload of the trojan is a proxy service listening on a fixed port. The port, along with other information about the infected system is periodically sent to the following list of web servers:


The proxy has a simple access control mechanism which prevents a certain list of addresses from using the proxy. The trojan obtains this list from another set of web servers:



Detection

F-Secure Anti-Virus detects this malware with the following updates:
[FSAV_Database_Version]
Version = 2006-03-23_04