Bagle variations reaching epidemic proportions

By Matt Whipp

Posted on 2 Jun 2005 at 12:32

The epidemic of email threats that download the Bagle virus continues apace, according to antivirus experts.

Maksym Schipka, senior antivirus researcher at MessageLabs, said 'The quantities are huge to be honest ...[this is] one of the largest Bagle downloaders we have ever seen. And we've seen three variants in the first three hours. These are repeated versions of the same malware, the only difference is the executable packers.'

This is a well-known technique, according to Shipka. 'It's tricky and resource consuming to add support for every packer,' he said. And there are hundreds of these compression packers. So some antivirus companies decide instead to issue a separate signature file each time a virus is packed, or compressed, differently - even though it is the same virus. Antivirus companies now say that there are eight variants of the Bagle downloader for the current strain alone.

Shipka said he thought that the high volumes of email carriers being spotted are probably the results of real infections, and not just the initial seeding efforts of the author.

The new worm arrives as an attachment in a blank email (both the subject line and body text are blank). If the recipient runs the attachment, the virus is activated and trawls through a list of online resources attempting to download a variant of the Bagle virus.

'Several of these websites are still working,' said Shipka. 'They're not all shut down.' So the downloading component is still able to get hold of copies of the Bagle virus and download it.

The virus also scours the infected computer for email addresses so that it can send itself on. The emails appear to have originated from a Yahoo! group.

Shipka suspected the purpose of the Bagle downloader was to refresh botnet databases and mailing lists. The marketplace for trading lists of compromised computers to spammers so that they can be used to send junk mail is now big business in the criminal underground. And so the more up to date these lists are, the higher the value.