full-disclosure - New Bagle variant

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: da.m0nk3y at gmail.com (da m0nk3y)
Subject: New Bagle variant

VIIF: (Very Important Information Fallows)
On Mon, 9 Aug 2004 16:22:17 -0600, Tremaine <tremaine@...il.com> wrote:
> The worm itself is packed with PeX, uses its own SMTP engine and
> contains a Mitglieder-like downloader.  It also opens a backdoor using

It is written in FORTH even tho it's made to look like it's coded
in turbo pascal upon disassembly.

> TCP and UDP port 2480 on the compromised machine.

Use `nmap -sS -sU -p 2480 ..' against the suspicious servers.

> The virus will transmit over SMTP, P2P and SMB.

It has not been publicly reported but it is polymorphable.

> The following reg keys will be present:
> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\win_upd2.
> exe = %System%\WINdirect.exe
> 
> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\erthgdr
> = %System%\windll.exe
> 
> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ru1n
> 

But the important keys will vary massively based upon a algorythm
that's been choosed carefully.

> The zip file contains non-functional code to password protect the zip.

We don't care cuz it will autopropagate new worms with new structures
containing different teqneeks to polymorph the stack
without corrupting your system's internal c library.

> It will attempt to send itself to email addresses it gathers from the
> system from files with the following extensions on the compromised
> system:
> ..adb
> ..asp
> ..cfg
> ..cgi
> ..dbx
> ..dhtm
> ..eml
> ..htm
> ..jsp
> ..mbx
> ..mdx
> ..mht
> ..mmf
> ..msg
> ..nch
> ..ods
> ..oft
> ..php
> ..pl
> ..sht
> ..shtm
> ..stm
> ..tbb
> ..txt
> ..uin
> ..wab
> ..wsh
> ..xls
> ..xml

You should verify your data again and carefully, big boy.
It doesn't has shit to do with ..wab, y0.

> --
> Tremaine
> IT Security Consultant

you should add a line: "and full-time slutwad"

> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

Full-Disclosure is raped again. sw1ndl 10/08/2004