New series of Bagles being spammed

Over the course of the last 10 hours or so we’ve seen a number of new Bagle variants.

We’ve just released an urgent update for the fourth spammed Bagle. And just like before these Bagles don’t spread any further.

We have also detected a Bagle which does have email spreading functionality, it sends the spammed samples.

The spammed Bagles arrive in a zip archive as a .cpl file. Most likely with “price” in one of the filenames. The .cpl files are all 14340 bytes in size.

All four variants are equal to each other, the only difference is in the .cpl dropper.
The .cpl file functions as Trojan-Dropper to drop the actual Bagle executable.

The most interesting part of this Bagle case is that the Bagle executable does not work on Windows XP or 2000, it only seems to work on Windows 98.

Currently we can only speculate as to the author’s motives to create malware which will only function on Windows 98.

We detect the .cpl droppers and mailer as Email-Worm.Win32.Bagle.cs, Bagle.ct and
The dropped files are detected as Bagle.cs.

MD5 checksums for the spammed Bagles:


New series of Bagles being spammed

Your email address will not be published. Required fields are marked *



Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Lazarus covets COVID-19-related intelligence

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

Sunburst: connecting the dots in the DNS requests

We matched private and public DNS data for the SUNBURST-malware root C2 domain with the CNAME records, to identify who was targeted for further exploitation. In total, we analyzed 1722 DNS records, leading to 1026 unique target name parts and 964 unique UIDs.

What did DeathStalker hide between two ferns?

While tracking DeathStalker’s Powersing-based activities in May 2020, we detected a previously unknown implant that leveraged DNS over HTTPS as a C2 channel, as well as parts of its delivery chain. We named this new malware “PowerPepper”.

Subscribe to our weekly e-mails

The hottest research right in your inbox