New series of Bagles being spammed

Over the course of the last 10 hours or so we’ve seen a number of new Bagle variants.

We’ve just released an urgent update for the fourth spammed Bagle. And just like before these Bagles don’t spread any further.

We have also detected a Bagle which does have email spreading functionality, it sends the spammed samples.

The spammed Bagles arrive in a zip archive as a .cpl file. Most likely with “price” in one of the filenames. The .cpl files are all 14340 bytes in size.

All four variants are equal to each other, the only difference is in the .cpl dropper.
The .cpl file functions as Trojan-Dropper to drop the actual Bagle executable.

The most interesting part of this Bagle case is that the Bagle executable does not work on Windows XP or 2000, it only seems to work on Windows 98.

Currently we can only speculate as to the author’s motives to create malware which will only function on Windows 98.

We detect the .cpl droppers and mailer as Email-Worm.Win32.Bagle.cs, Bagle.ct and Bagle.cu.
The dropped files are detected as Bagle.cs.

MD5 checksums for the spammed Bagles:

4fb426de872ee9b20c3312fae3adf018
a2920da32385932c71ad2e4ed5e3e74e
951053055f16d331a42475c209803430
37e84e6c22bfe936b48aea4ade395044