New Bagel Worm Speading

Repost from: http://www.eweek.com/article2/0,1759,1756823,00.asp

Bagle Worm Mutants Multiplying Fast

By Ryan Naraine

January 28, 2005

Be the first to comment on this article

Almost a year after the first Bagle worm started squirming through e-mail in-boxes, anti-virus vendors are reporting a new wave of attacks with new propagation techniques.

Three new variants were detected over the past 24 hours, and because of the high rate of distribution, anti-virus firms have increased the threat level and have rushed out signature updates.

ADVERTISEMENT

One new mutant, Bagle.AY, is polymorphic and uses peer-to-peer spreading capabilities to multiply. It contains a backdoor that listens on TCP port 81 and is programmed to cease its activity on April 25, 2006, according to an alert from Finnish research firm F-Secure.

Anti-virus vendors McAfee Inc., Trend Micro Inc., Panda Software and Symantec Inc. all have raised their alert ratings and have issued warnings because of the worm's rapid rate of propagation.

"Everyone should be cautious of unsolicited e-mail attachments, and be wary of what they download from Internet file-sharing networks," said Graham Cluley, senior technology consultant at Sophos, a Lynnfield, Mass.-based security outfit.

Bagle.AY arrives in e-mail as a packed executable and is also capable of spreading with a prepended Windows CPL (control panel applet) stub. When spreading as a CPL file, the worm prepends a small binary dropper to its executable file. If that file is activated, the worm copies itself as cjector.exe file to the Windows folder and then drops the file into the Windows System folder.

eWEEK.com Special Report: Worm Attacks

The latest spawn spreads itself in e-mails with randomly chosen subject lines, mail text bodies and attachment names. The worm can attach itself to e-mails as an executable file with COM, EXE, SCR and CPL extensions.

Like its predecessors, the worm's backdoor code is password-protected, allowing the worm's author access to connect to the infected computer to execute arbitrary programs. Infected computers are reported to the worm's author by accessing several predefined URLs.

Symantec also reported the detection of W32.Beagle.AZ and warned that distribution

remained high throughout Friday.

-----------------------------------------------------------------------------------------

cv