Bangkok--Mar 6--Core & Peak
Notorious for its ability to spread huge volumes of spam email, the WORM_BAGLE has recently been spotted using a new trick — disguising itself as a ticket company offering free tickets to the 2006 Turin Winter Olympics.
The Trend Micro global antivirus research and technology support center TrendLabs has detected a new variant of the Bagle virus identified as WORM_BAGLE.EV. Like its predecessors, BAGLE.EV launches its first attack through a Trojan embedded in an email attachment. The worm then copies itself to folders with names including the letters “SHAR,” such as shared folders for P2P file transfer programs so as to continue distribution through applications or adult photos.
WORM_BAGLE.EV attempts to evade detection by standard security software. Therefore, users should install antivirus software that can send proactive alerts when a new virus variant strikes and can automatically update itself with the latest virus patterns. Security software should also be able to temporarily disable other external network links while updating virus patterns to reduce the risk of infection.
Trend Micro noted that emails with the WORM_BAGLE.EV may contain a combination of any of the following subject lines and attachments:
Possible Subject Lines:
FREE OLYMPIC TICKETS LOTTERY!
2006 Winter Games in Torino
2006 Torino Winter Games FREE Tickets
Possible Attachment Files:
Generated_bill.exe
Order_details.exe
Service_receipt.exe
The body of the email typically includes a message from Olympics ticket suppliers TicketWorld, Coast to Coast Tickets and SuperTicketing Premium Seating. The email may also include the following messages to increase believability: “Any trademarks used in this communication are for informational purposes only.” “All ticket prices are in US$ dollars.” “All Opening Ceremony tickets will be delivered via FedEx.” Emails also may include the ticket supplier’s phone number to increase authenticity, but the key lure is the following: “Open the attached file to find out how to receive your free tickets.” “Free ticket drawing — please see attachment for details.” “Note: the attached invitation includes your free tickets.” As soon as the attachment is opened, the malware displays a warning dialog stating that the attachment cannot be opened. However, by this time the Bagle worm has listed itself as an exception in the user’s firewall and deleted security-related system registry values to avoid detection.
Trend Micro noted that WORM_BAGLE.EV distributes mass emails as well as replicating itself via peer-to-peer networks. Any file folder with the string “SHAR” can be used to copy the worm, such as “My Shares” or “ Shared Music,” etc. File names can include popular software titles such as “Adobe Photoshop 9 full.exe,” “IE beta 7.exe,” “Windows Sourcecode update.doc.exe,” or pornographic files such as “anna benson sex video.exe,” “barrett jackson nude photos,” “movies,” “porn video.exe,” etc.
TrendLabs noted that in recent years malware has utilized a wide variety of distribution methods. The Bagle worm, which continues to evolve and spawn new variants, is one such example. Bagle employs a wide range of methods to attack systems, including: writing automatic launch settings, downloading worms, disabling processes and deleting files, implanting DLL files, uninstalling third-party applications and their auto-startup settings, creating mutual exclusion objects (mutex), repackaging programs/compressed files, disabling Windows services, renaming files, etc.
Trend Micro also pointed out that this malware may continue evolving and producing new variants. Concerns exist that the malware writers may employ Rootkit technologies or utilize irregular format JPEG/EMF/WMF files. Trend Micro recommends that users install PC security software that fully counteracts mixed-threat attacks and can completely block and clean all types of malware including worms, Trojans and other viruses.
For more information,
please visit the Trend Micro website: www.trendmicro.com
For Media Inquiries
Srisuput SiangyenPR Consultant
Core & Peak Co., Ltd.
Tel. 02-439-4600 ext. 8300
Email:[email protected] End.