Bugbear
Threat LevelDamageDistribution

Effects 

The worm's main action consists of attacking files used by antivirus programs and firewalls.

For further information on the files used, click here.

Infection strategy 

Bugbear creates the following files:

• ~PHQGHUM.TMP (20 Bytes), in the Windows temporary directory.
• Two files with a random name and the EXE extension (executable files). One of the files is copied to the Windows system directory, and the other to the Windows startup directory. These two files are run on every Windows startup.     
• A file with a DLL extension (library), in the Windows system directory.

Bugbear creates the following entry in the Windows Registry:

• HKLM\ Software\ Microsoft\ Windows\ CurrentVersion\ RunOnce=
  The worm assings a value to this entry that refers to the EXE file it created in the Windows system directory. Through this entry the worm ensures it is run on every Windows startup.   

Finally, Bugbear carries out the following actions:

• It takes advantage of the Iframe Exploit vulnerability.
• It uses port 36794 to establish remote connections.
• It is designed to avoid sending the file that triggers infection to e-mail addresses with any of the following words: list, localdomain, localhost, lyris, mailer-daemon, majordom, nobody@, noreply, postmaster@, recipients, remove, root@, spam, talk, ticket, trojan, undisclosed, virus.

Means of transmission 

Bugbear reaches computers in an e-mail message with variable subjects and contents. Consequenty, it is difficult to recognize the e-mail that carries the worm and easy to become infected by it.

The most recurrent features are the following:

Bugbear creates a false address which appears as the sender of the e-mail message. This can cause confusion. For more information, click here.

Further Details  

Bugbear has a size of 50688 Bytes (compressed with UPX) and is written in the Visual C programming language.