Win32.Bagle.W@mm( TrojanProxy.Win32.Mitglieder.ag, I-Worm.Bagle.u (KAV), WORM_BAGLE.W (TrendMicro) )
SYMPTOMS: - the files irun4.exe, iinj4.exe and system.exe in the Windows System folder;- the registry key HKCU\Software\DateTime; - the registry entry HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ssgrate.exe (pointing to the irun4.exe in the Windows System folder). TECHNICAL DESCRIPTION: Although it appears to have been written in Assembler, this worm (like its previous versions) makes intelligent use of advanced Windows functions such as Structured Storage that simplify its code and make it rather elegant. The worm was linked with Visual Studio\'s linker and packed with UPX.It uses the backdoor installed by a previous version (Win32.Bagle.U@mm) on port 4751 to infect computers that are infected with that version. Although it provides some sort of SMTP relay, it does not send emails with its body (it is not a mass-mailer). When run, it checks the command line for the "-del" and "-upd" arguments; "-del" uninstalls the worm and terminates the execution; "-upd" uninstalls the worm and continues the execution (this switch is used for updating). A mutex called "imain_mutex" is used to specify/check that the virus is running. It drops two DLL files (iinj4.exe and system.exe) in the Windows System folder; it injects the DLL iinj4.exe in the process whose thread created the window "Shell_TrayWnd" (the Explorer process); this DLL will load a few system DLL\'s and then load the DLL system.exe, which contains the actual worm. (Although iinj4.exe and system.exe have the .exe extension, they are actually DLL\'s). The registry entry HKCU\Software\DateTime\uid is initialized to a sring of 9 random non-zero digits; the registry entry HKCU\Software\Microsoft\Windows\CurrentVersion\run\ssgrate.exe is created to run irun4.exe (from the Windows System folder) at start-up; the registry entry HKCU\Software\DateTime\port is initialized to a random number in the range 2000 to 49999 that will be used as the port to bind the backdoor to. The registrry entry HKCU\Software\DateTime\lnei is created when the virus is run for the second time; the presence of this entry will determine scanning the network for older versions and updating them. A thread is created that will look (every 0.1 seconds) for processes whose names include strings from the list below, and terminate them. OUTPOST.EXE NMAIN.EXE NORTON_INTERNET_SECU_3.0_407.EXE NPF40_TW_98_NT_ME_2K.EXE NPFMESSENGER.EXE NPROTECT.EXE NSCHED32.EXE NTVDM.EXE NVARCH16.EXE KERIO-WRP-421-EN-WIN.EXE KILLPROCESSSETUP161.EXE LDPRO.EXE LOCALNET.EXE LOCKDOWN.EXE LOCKDOWN2000.EXE LSETUP.EXE CLEANPC.EXE AVprotect9x.exe CMGRDIAN.EXE CMON016.EXE CPF9X206.EXE CPFNT206.EXE CV.EXE CWNB181.EXE CWNTDWMO.EXE ICSSUPPNT.EXE DEFWATCH.EXE DEPUTY.EXE DPF.EXE DPFSETUP.EXE DRWATSON.EXE ENT.EXE ESCANH95.EXE AVXQUAR.EXE ESCANHNT.EXE ESCANV95.EXE AVPUPD.EXE EXANTIVIRUS-CNET.EXE FAST.EXE FIREWALL.EXE FLOWPROTECTOR.EXE FP-WIN_TRIAL.EXE FRW.EXE FSAV.EXE AUTODOWN.EXE FSAV530STBYB.EXE FSAV530WTBYB.EXE FSAV95.EXE GBMENU.EXE GBPOLL.EXE GUARD.EXE GUARDDOG.EXE HACKTRACERSETUP.EXE HTLOG.EXE HWPE.EXE IAMAPP.EXE IAMAPP.EXE IAMSERV.EXE ICLOAD95.EXE ICLOADNT.EXE ICMON.EXE ICSUPP95.EXE ICSUPPNT.EXE IFW2000.EXE IPARMOR.EXE IRIS.EXE JAMMER.EXE ATUPDATER.EXE AUPDATE.EXE KAVLITE40ENG.EXE KAVPERS40ENG.EXE KERIO-PF-213-EN-WIN.EXE KERIO-WRL-421-EN-WIN.EXE BORG2.EXE BS120.EXE CDP.EXE CFGWIZ.EXE CFIADMIN.EXE CFIAUDIT.EXE AUTOUPDATE.EXE CFINET.EXE NAVAPW32.EXE NAVDX.EXE NAVSTUB.EXE NAVW32.EXE NC2000.EXE NCINST4.EXE AUTOTRACE.EXE NDD32.EXE NEOMONITOR.EXE NETARMOR.EXE NETINFO.EXE NETMON.EXE NETSCANPRO.EXE NETSPYHUNTER-1.2.EXE NETSTAT.EXE NISSERV.EXE NISUM.EXE CFIAUDIT.EXE LUCOMSERVER.EXE AGENTSVR.EXE ANTI-TROJAN.EXE ANTI-TROJAN.EXE ANTIVIRUS.EXE ANTS.EXE APIMONITOR.EXE APLICA32.EXE APVXDWIN.EXE ATCON.EXE ATGUARD.EXE ATRO55EN.EXE ATWATCH.EXE AVCONSOL.EXE AVGSERV9.EXE AVSYNMGR.EXE BD_PROFESSIONAL.EXE BIDEF.EXE BIDSERVER.EXE BIPCP.EXE BIPCPEVALSETUP.EXE BISP.EXE BLACKD.EXE BLACKICE.EXE BOOTWARN.EXE NWINST4.EXE NWTOOL16.EXE OSTRONET.EXE OUTPOSTINSTALL.EXE OUTPOSTPROINSTALL.EXE PADMIN.EXE PANIXK.EXE PAVPROXY.EXE DRWEBUPW.EXE PCC2002S902.EXE PCC2K_76_1436.EXE PCCIOMON.EXE PCDSETUP.EXE PCFWALLICON.EXE PCFWALLICON.EXE PCIP10117_0.EXE PDSETUP.EXE PERISCOPE.EXE PERSFW.EXE PF2.EXE AVLTMAIN.EXE PFWADMIN.EXE PINGSCAN.EXE PLATIN.EXE POPROXY.EXE POPSCAN.EXE PORTDETECTIVE.EXE PPINUPDT.EXE PPTBC.EXE PPVSTOP.EXE PROCEXPLORERV1.0.EXE PROPORT.EXE PROTECTX.EXE PSPF.EXE WGFE95.EXE WHOSWATCHINGME.EXE AVWUPD32.EXE NUPGRADE.EXE WHOSWATCHINGME.EXE WINRECON.EXE WNT.EXE WRADMIN.EXE WRCTRL.EXE WSBGATE.EXE WYVERNWORKSFIREWALL.EXE XPF202EN.EXE ZAPRO.EXE ZAPSETUP3001.EXE ZATUTOR.EXE CFINET32.EXE CLEAN.EXE CLEANER.EXE CLEANER3.EXE CLEANPC.EXE CMGRDIAN.EXE CMON016.EXE CPD.EXE CFGWIZ.EXE CFIADMIN.EXE PURGE.EXE PVIEW95.EXE QCONSOLE.EXE QSERVER.EXE RAV8WIN32ENG.EXE REGEDT32.EXE REGEDIT.EXE UPDATE.EXE RESCUE.EXE RESCUE32.EXE RRGUARD.EXE RSHELL.EXE RTVSCN95.EXE RULAUNCH.EXE SAFEWEB.EXE SBSERV.EXE SD.EXE SETUP_FLOWPROTECTOR_US.EXE SETUPVAMEEVAL.EXE SFC.EXE SGSSFW32.EXE SH.EXE SHELLSPYINSTALL.EXE SHN.EXE SMC.EXE SOFI.EXE SPF.EXE SPHINX.EXE SPYXX.EXE SS3EDIT.EXE ST2.EXE SUPFTRL.EXE LUALL.EXE SUPPORTER5.EXE SYMPROXYSVC.EXE SYSEDIT.EXE TASKMON.EXE TAUMON.EXE TAUSCAN.EXE TC.EXE TCA.EXE TCM.EXE TDS2-98.EXE TDS2-NT.EXE TDS-3.EXE TFAK5.EXE TGBOB.EXE TITANIN.EXE TITANINXP.EXE TRACERT.EXE TRJSCAN.EXE TRJSETUP.EXE TROJANTRAP3.EXE UNDOBOOT.EXE VBCMSERV.EXE VBCONS.EXE VBUST.EXE VBWIN9X.EXE VBWINNTW.EXE VCSETUP.EXE VFSETUP.EXE VIRUSMDPERSONALFIREWALL.EXE VNLAN300.EXE VNPC3000.EXE VPC42.EXE VPFW30S.EXE VPTRAY.EXE VSCENU6.02D30.EXE VSECOMR.EXE VSHWIN32.EXE VSISETUP.EXE VSMAIN.EXE VSMON.EXE VSSTAT.EXE VSWIN9XE.EXE VSWINNTSE.EXE VSWINPERSE.EXE W32DSM89.EXE W9X.EXE WATCHDOG.EXE WEBSCANX.EXE CFIAUDIT.EXE CFINET.EXE ICSUPP95.EXE MCUPDATE.EXE CFINET32.EXE CLEAN.EXE CLEANER.EXE LUINIT.EXE MCAGENT.EXE MCUPDATE.EXE MFW2EN.EXE MFWENG3.02D30.EXE MGUI.EXE MINILOG.EXE MOOLIVE.EXE MRFLUX.EXE MSCONFIG.EXE MSINFO32.EXE MSSMMC32.EXE MU0311AD.EXE NAV80TRY.EXE ZAUINST.EXE ZONALM2601.EXE ZONEALARM.EXE Another thread will wait for the computer to connect to the Internet and (after 1 minute) will communicate the "port" and "uid" variables to the following web locations (every 320 minutes; the HTTP agent name used is "i_am_ideal"): http://www.lowenbrau.ru/manager_old/images/ngr2.php http://www.ctn.ru/marketing/images/ngr2.php http://alfinternational.ru/old/oli-lack_katalog/ngr2.php http://www.psnr.ru/rus/images/banners/ngr2.php http://www.gasterixx.de/gfx/ngr2.php http://www.deadlygames.de/DG/BF/BF-Links/clans/ngr2.php http://www.o-problemo.de/gaestebuch/ngr2.php http://www.tv87.de/subdomain_la/Fachwart/ngr2.php http://www.ranknet.de/LVS/pics/_notes/ngr2.php http://www.joerrens.de/system/include/crc.php http://www.bbszene.de/store/images/video_amazon/ngr2.php http://www.gebr-wachs.de/mod/san_beratung/thumb/ngr2.php http://www.lords-of-havoc.de/Avatare/ngr2.php http://comdat.de/kreta/ngr2.php http://www.eurostretch.ru/ngr2.php http://mir-auto.ru/ngr2.php http://artesproduction.com/ngr2.php http://www.hhc-online.de/home/links/pics/ngr2.php http://gaz-service.ru/img/pict/ngr2.php http://rdwufa.ru/img/pict/ngr5.php http://www.komandor.ru/sessions/ngr2.php http://www.mirage.ru/sport/omega/pic/omega/ngr3.php http://prizmapr.ru/test/images/ngr2.php http://avistrade.ru/prog/img/proizvod/ngr2.php http://service6.valuehost.ru/images/ngr2.php http://www.thomas-we.de/Design/ngr2.php http://partiyazerna.1gb.ru/menu/analitika/ngr2.php http://pvcps.ru/images/ngr2.php http://monomah-city.ru/vakans/ngr2.php http://mir-vesov.ru/p/lang/CVS/ngr2.php http://promco.ru/sovrem/panorama/ngr2.php http://www.13tw22rigobert.de/_themes/kopie-von-fantasie-in-blau/ngr2.php http://die-cliquee.de/inhalt/mitglieder/foto/ngr2.php If the entry HKCU\Software\DateTime\lnei entry has been found in the registry, a thread is created that will scan the network for port 4751 open and update the older Bagle version running on those computers with this version. IP\'s near the local machine\'s IP are used every 5 iterations of the loop (20% of the time); for the other 80% of iterations, random IP\'s are used (a.b.c.d, where a, b, c and d are all in the range 0 to 239). Before starting the backdoor, a "ban list" is downloaded from the following URL\'s to ban_list.txt in the Windows System folder: http://www.lowenbrau.ru/manager_old/images/banlist.php http://comdat.de/kreta/banlist.php http://www.psnr.ru/rus/images/banners/banlist.php http://gaz-service.ru/img/pict/banlist.php http://rdwufa.ru/img/pict/banlist.php http://prizmapr.ru/test/images/banlist.php http://avistrade.ru/prog/img/proizvod/banlist.php http://service6.valuehost.ru/images/banlist.php http://www.thomas-we.de/Design/banlist.php http://partiyazerna.1gb.ru/menu/analitika/banlist.php http://pvcps.ru/images/banlist.php http://monomah-city.ru/vakans/banlist.php http://mir-vesov.ru/p/lang/CVS/banlist.php http://promco.ru/sovrem/panorama/ngr2.php http://www.13tw22rigobert.de/_themes/kopie-von-fantasie-in-blau/banlist.php http://die-cliquee.de/inhalt/mitglieder/foto/banlist.php This ban list can specify IP\'s and IP ranges that the backdoor refuses connections to. The backdoor is run on the random TCP "port" chosen before. Based on data exchanged with the client, it can do the following: - bind the backdoor to a different port; - udpate itself (the client uploads an executable which is dropped to the Windows folder using the name "iuplda<5 random letters except y and z>.exe" and is run with the "-upd" switch); - uninstall the worm; - act as an email relay; received emails will be sent to the recipient\'s DNS-resolved SMTP server; the user\'s configured DNS server or the hardcoded 217.5.97.137 DNS server is used; - run a command specified by the client; - download a file from a specified Internet location (to "iuplda<5 random letters except \'y\' and \'z\'>.exe" in the Windows folder) and run it; - act as a proxy. Removal instructions: Manual Removal:From the Start menu, choose Run and execute the following command line (which runs the worm and asks it to uninstall itself): irun4 -del Now you should be able to run the Registry Editor (regedit) and remove the registry entry HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ssgrate.exe. Automatic Removal: Let BitDefender delete infected files. ANALYZED BY: Bogdan Dragu, BitDefender Virus Researcher |