W32/Bagle.AU Worm

 Information about the W32/Bagle.AU Worm:

W32/Bagle.AU is an email worm. This worm is a variant of W32/Bagle.A. The worm will infect Windows systems. The worm spreads through email, shared network drives, KaZaA P2P software and network.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected email will be any one of the following.

Re:
Re: Hi
Re: Thank you!
Re: Thanks :)
Re: Hello

The body of the infected email will be the any one of the following;

:))
:)

It carries any one of the following infected attachments;

Joke
price

The extension of the attachment may be any one of the following;

.cpl
.scr
.exe
.com

Upon execution of the attachment, the worm copies itself as wingo.exe, wingo.exeopen and wingo.exeopenopen in the Windows System folder.

It alters the windows registry at the following location to load itself during next startup;

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also creates several mutex to ensure only one instance of the worm is running.

_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_
'D'r'o'p'p'e'd'S'k'y'N'e't'
____--->>>>U<<<<--____
MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D
AdmSkynetJklS003
[SkyNet.cz]SystemsMutex
_-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_

The worm attempts to create copies of itself in any folder that contains the substring shar. The worm files will have the following file names:

ACDSee 9.exe
Adobe Photoshop 9 full.exe
Ahead Nero 7.exe
Kaspersky Antivirus 5.0
KAV 5.0
Matrix 3 Revolution English Subtitles.exe
Microsoft Office 2003 Crack, Working!.exe
Microsoft Office XP working Crack, Keygen.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Opera 8 New!.exe
Porno pics arhive, xxx.exe
Porno Screensaver.scr
Porno, sex, oral, anal cool, awesome!!.exe
Serials.txt.exe
WinAmp 5 Pro Keygen Crack Update.exe
WinAmp 6 New!.exe
Windown Longhorn Beta Leak.exe
Windows Sourcecode update.doc.exe
XXX hardcore images.exe

The worm attempts to connect to some websites in its pre-configured list.

To propagate itself, the worm scans the following extensions and collects the available email addresses from the infected system;