Rewterz Threat Advisory – Bagle worm returns with email spam campaigns

A fresh wave of mass-email spam campaign is detected, deploying the Bagle worm on Windows systems.

IMPACT:  MEDIUM

PUBLISH DATE:  11-DEC-2018

OVERVIEW

The Bagle worm (aka Beagle, Bagel) is deployed through spam emails and contains a backdoor that gives attackers remote access to vulnerable systems, allowing them to download malware from the internet.

ANALYSIS

The worm was first seen in 2004, and has introduced many variants since then. The fresh email spam campaigns are observed to be using the first two variants Bagle.A and Bagel.B.

In the current campaign, “‘Hi’ is the mail’s subject and the message is ‘Test =)’, which is followed by a series of random characters with ‘Test, yep.’ at the end,” researchers explained. The email has a spoofed sender line, like most spam emails.

The attachment name has random letters with a ‘.exe’ file extension and the icon mostly looks like the Windows calculator.

On execution, the file bbeagle.exe is added to the Windows system folder. This is followed by the launch of the file calc.exe (the Windows Calculator).

The value “d3dupdate.exe = (system folder directory)\bbeagle.exe” is then added to the current user’s registry key, following which, programs begin to run automatically after the system gets started. The worm could further add the values “uid = [Random Value]” and “frun = 1” to registry key HKEY_CURRENT_USER\Software\Windows98.

The worm proceeds to develop the listening thread on TCP port 6777 to receive specially formatted messages from the attackers; which direct it to download an arbitrary file to the Windows system folder.

For propagation, the worm hunts down email addresses in files with extensions .wab, .txt, .htm, and .html, and will begin sending itself out to them. Also, the worm keeps on notifying its C&C servers about its presence every ten minutes.

“After implementation, Bagle will check the system date and may not even do anything if the date goes beyond a specific point (2004.01.28 for Beagle.A),” researchers said. “If the date on the infected computer appears to be wrong and displays a date before the time the worm is supposed to stop running, it will then run and continue to spread from that computer.”

AFFECTED PRODUCTS

Windows systems

MITIGATION

Keep your antivirus software updated on all systems.

Most importantly, the campaign uses the weakest element of information security, i.e: humans. Therefore, employees should be trained to avoid falling victim to email spams. Employees must avoid clicking suspicious URLs or downloading email attachments coming from unverified sources .

If you think you’re a victim of a cyber-attack, immediately send an email to soc@rewterz.com.