Welcome to the Virus Encyclopedia of Panda Security.
Bagle.U carries out the following actions:
It creates a backdoor that opens the TCP port 4751, and listens to it.
It downloads an update of itself (A.EXE file) from the Internet through the opened port.
It checks for an available Internet connection every two seconds. If successful, it attempts to connect to a web page that hosts a PHP script:
By doing this, Bagle.U notifies its author that the affected computer can be accessed through the opened port. If it is unable to send this notification, it retries every 100,000 seconds.
This worm only runs if the system date is January 1, 2005 or previous. After this date, Bagle.U stops functioning.
It opens the Windows game Hearts, if it is installed in the affected computer. This game is usually installed with Windows operating systems.
Bagle.U creates the following files:
GIGABIT.EXE in the Windows system directory. This file is a copy of the worm. If Bagle.U is run from other file than this, it opens the Windows game Hearts.
A.BAT. When this batch file is run, it deletes the worm.
A.EXE in the Windows directory. This file is downloaded from the Internet through the opened port.
Bagle.U creates the following entries in the Windows Registry:
- HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ Current Version \Run
Gigabit.exe = %sysdir%\ gigabit.exe
where %sysdir% is the Windows system directory.
By creating this entry, Bagle.U ensures that it is run whenever Windows is started.
- HKEY_CURRENT_USER\ SOFTWARE\ Windows2004
gsed = %random%
where %random% is a random value, which will be used during the execution of the worm.
- HKEY_CURRENT_USER\ Software\ Windows2004
frn = 1
This entry indicates that Bagle.U has been currently run for the first time.
Means of transmission
Bagle.U spreads via e-mail. It follows the routine below:
It reaches the computer in an e-mail message with the following characteristics:
spoofs the e-mail address from which it is sent. This may cause confusion. For further information, click here.
Subject: it is blank.
Message: it is blank.
It has an attached file with a variable file name, but which always has an EXE
This attached file has the following icon:
The computer is affected when the attached file is run.
Bagle.U searches for e-mail addresses in files that have the following extensions: ADB, ASP, CFG, CGI, DBX, DHTM, EML, HTM, JSP, MBX, MDX, MHT, MMF, MSG, NCH, ODS, OFT, PHP, SHT, SHTM, STM, TBB, TXT, UIN, WAB, WSH, XLS and XML.
It looks for this files in all the drives of the affected computer, excepting floppy drives, CD-ROMs and other removable media.
It sends itself out to all the addresses it has gathered using its own SMTP engine, excepting those which belong to the mail domains @microsoft and @avp.
It sends a message every five seconds.
Bagle.U is written in the programming language Visual C. This worm is 8,208 bytes in size when it is compressed with FSG, and approx. 50 Kbytes once it is decompressed.