WORM_BAGLE.SS

This worm arrives as attachment to email messages spammed by another malware or a malicious user. It may be downloaded from remote sites by other malware. It may be dropped by other malware.

It drops copies of itself. It drops a file detected by Trend Micro as WORM_NUWAR.ACE.

It creates registry entries to enable its automatic execution at every system startup.

It creates registry key(s)/entry(ies).

It gathers target email addresses from files with certain file name extensions. It avoids sending email messages to addresses containing certain strings. It uses its own Simple Mail Transfer Protocol (SMTP) engine to send email messages with a copy of itself as attachment.

Related Items