Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Win32/Bagle.DD

   
Aliases: Trojan.Downloader.Bagle.E (Bitdefender), Email-Worm.Win32.Bagle.ef (Kaspersky), Trj/Mitglieder.FK (Panda)
Type: TrojanDownloader
Systems Affected: 32-Bit Windows

Win32/Bagle.DD is functionally the same as Win32/Bagle.DC with the difference being that the files used by Bagle.DD are runtime compressed to attempt to evade detection.

Installation and Autostart Techniques:

Upon execution, the trojan drops its downloader component "hleader_dll.dll" into the %SYSTEM% folder and copies itself as a 13312 byte file named "hloader_exe.exe".
This Dynamic Link Library gets loaded via Code Injection (WriteProcessMemory / CreateRemoteThread) into the explorer process and runs there cloaked.

NOTE: %System% denotes Windows System directory (e.g. C:\WINDOWS\SYSTEM32) as they differ on various versions of Microsoft Windows.

The trojan adds the following keys to the registry to make sure that it runs every time windows is started:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
"auto__hloader__key" = "%System\hloader_exe.exe"

And

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
"auto__hloader__key" = "%System\hloader_exe.exe"

That means, that every time windows is started the executable injects the downloader DLL into the Explorer Process.

Downloading DLL Component:

This DLL retrieves the Windows Directory via GetWindowsDirectoryA API. After this, the downloader constructs a download directory in the windows folder named "exefld". Then, the downloader first tries to delete all files in this directory using the Shell Fileoperating API (SHFileOperationA).

Bagle.DD tries to download files from several internet locations. These URL's are stored in a string array and the downloaded file will be stored in the folder "exefld" under the windows folder. After successful download the Downloader tries to execute this file via ShellExecuteA API.

The name of the downloaded executable is randomly constructed via GetTickCount API.

Bagle.DD creates its own timed threads for interval downloading. It will try to download files from the following internet locations every 4 hours:

http://www.aro-tec.com/{REMOVED}/w.php
http://sarancha.ru/{REMOVED}/w.php
http://home.1000km.ru/{REMOVED}/w.php
http://www.stanislawkowalczyk.netstrefa.com/{REMOVED}/w.php
http://1st-new-orleans-hotels.com/{REMOVED}/w.php
http://www.OTT-INSIDE.de/{REMOVED}/w.php
http://lifejacks.de/{REMOVED}/w.php
http://25kadr.org/{REMOVED}/w.php
http://africa-tours.de/{REMOVED}/w.php
http://wunderlampe.com/{REMOVED}/w.php
http://charlies-truckerpage.de/{REMOVED}/w.php
http://template.nease.net/{REMOVED}/w.php
http://s89.tku.edu.tw/{REMOVED}/w.php
http://phrmg.org/{REMOVED}/w.php
http://www.etwas-mode.de/{REMOVED}/w.php
http://www.rewardst.com/{REMOVED}/w.php
http://757555.ru/{REMOVED}/w.php
http://www.8ingatlan.hu/{REMOVED}/w.php
http://oklens.co.jp/{REMOVED}/w.php
http://www.a2zhostings.com/{REMOVED}/w.php
http://www.abavitis.hu/{REMOVED}/w.php
http://abtechsafety.com/{REMOVED}/w.php
http://acentrum.pl/{REMOVED}/w.php
http://www.adamant-np.ru/{REMOVED}/w.php
http://furdoszoba.info/{REMOVED}/w.php
http://adavenue.net/{REMOVED}/w.php
http://ccooaytomadrid.org/{REMOVED}/w.php
http://abtechsafety.com/{REMOVED}/w.php
http://av2026.comex.ru/{REMOVED}/w.php
http://80.146.233.41/{REMOVED}/w.php
http://www.barth.serwery.pl/{REMOVED}/w.php
http://www.leap.co.il/{REMOVED}/w.php
http://virt33.kei.pl/{REMOVED}/w.php
http://www.bmswijndepot.com/{REMOVED}/w.php
http://209.126.128.203/{REMOVED}/w.php
http://www.timecontrol.com.pl/{REMOVED}/w.php
http://adoptionscanada.ca/{REMOVED}/w.php
http://65.108.195.73/{REMOVED}/w.php
http://tkdami.net/{REMOVED}/w.php
http://www.ubu.pl/{REMOVED}/w.php
http://adventecgroup.com/{REMOVED}/w.php
http://sacafterdark.net/{REMOVED}/w.php
http://agenciaspublicidadinternet.com/{REMOVED}/w.php
http://www.agroturystyka.artneo.pl/{REMOVED}/w.php
http://kepter.kz/{REMOVED}/w.php
http://ahava.cafe24.com/{REMOVED}/w.php
http://mijusungdo.net/{REMOVED}/w.php
http://aibsnlea.org/{REMOVED}/w.php
http://aikidan.com/{REMOVED}/w.php
http://202.44.52.38/{REMOVED}/w.php
http://drinkwater.ru/{REMOVED}/w.php
http://ala-bg.net/{REMOVED}/w.php
http://allinfo.com.au/{REMOVED}/w.php
http://eleceltek.com/{REMOVED}/w.php
http://alevibirligi.ch/{REMOVED}/w.php
http://alfaclassic.sk/{REMOVED}/w.php
http://allanconi.it/{REMOVED}/w.php
http://www.americarising.com/{REMOVED}/w.php
http://americasenergyco.com/{REMOVED}/w.php
http://amerykaameryka.com/{REMOVED}/w.php
http://amistra.com/{REMOVED}/w.php
http://analisisyconsultoria.com/{REMOVED}/w.php
http://calamarco.com/{REMOVED}/w.php

via TCP/IP port 80 (HTTP)

This timed download is done via EventManagement in the downloader thread. Bagle.DD initializes the timed event with DBBA00h which is exactly 4 hours.

History: Analysis and Write-up by: Michael St. Neitzel