Over the course of the last 10 hours or so we’ve seen a number of new Bagle variants.
We’ve just released an urgent update for the fourth spammed Bagle. And just like before these Bagles don’t spread any further.
We have also detected a Bagle which does have email spreading functionality, it sends the spammed samples.
The spammed Bagles arrive in a zip archive as a .cpl file. Most likely with “price” in one of the filenames. The .cpl files are all 14340 bytes in size.
All four variants are equal to each other, the only difference is in the .cpl dropper.
The .cpl file functions as Trojan-Dropper to drop the actual Bagle executable.
The most interesting part of this Bagle case is that the Bagle executable does not work on Windows XP or 2000, it only seems to work on Windows 98.
Currently we can only speculate as to the author’s motives to create malware which will only function on Windows 98.
We detect the .cpl droppers and mailer as Email-Worm.Win32.Bagle.cs, Bagle.ct and Bagle.cu.
The dropped files are detected as Bagle.cs.
MD5 checksums for the spammed Bagles: