TR/Bagle.GB.35 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Bagle.GB.35
Date discovered:	13/02/2007
Type:	Trojan
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	287.232 Bytes
MD5 checksum:	edec5388157140166151af3b4c5ad4a2
VDF version:	6.37.01.39 - Tue, 06 Feb 2007 07:30 (GMT+1) - Tue, 06 Feb 2007 07:30 (GMT+1)
IVDF version:	6.37.01.39 - Tue, 06 Feb 2007 07:30 (GMT+1) - Tue, 06 Feb 2007 07:30 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Kaspersky: Email-Worm.Win32.Bagle.gb
   • Grisoft: I-Worm/Bagle.PY

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops a file
   • Drops a malicious file
   • Registry modification
   • Makes use of software vulnerability

Files It creates the following directory:
• %PROGRAM FILES%\DeskAdTop

The following files are created:

– %PROGRAM FILES%\DeskAdTop\sInfo.ini
– %SYSDIR%\NTUP1.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Bagle.GB.36

Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "IEBarUp"="RunDll32 "%SYSDIR%\NTUP1.dll",Run

Network Infection Exploit:
It makes use of the following Exploit:
– MS04-007 (ASN.1 Vulnerability)

Backdoor Contact server:
The following:
   • http://218.12.196.140/route/**********

This is done via the HTTP GET request on a PHP script.

Sends information about:
    • Current malware status
    • Malware uptime

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• ASProtect

See a brief description here.

Description inserted by Monica Ghitun on Tue, 13 Feb 2007 16:22 (GMT+1)
Description updated by Andrei Ivanes on Mon, 19 Feb 2007 09:13 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back