W32/Bagle-GT is a mass-mailing worm for the Windows platform.
Messages sent by the worm will have the following characteristics:
The message text and subject both consist of non-latin characters. The attachment name also consist of non-latin characters, with a file extension of .hta.
W32/Bagle-GT includes functionality to access the internet and communicate with a remote server via HTTP.
W32/Bagle-GT is a mass-mailing worm for the Windows platform.
Messages sent by the worm will have the following characteristics:
The message text and subject both consist of non-latin characters. The attachment name also consist of non-latin characters, with a file extension of .hta.
When run, this attachment, detected as W32/Bagle-GT, drops and runs a file also detected as W32/Bagle-GT.
When this file is run it copies itself to <Windows>\csrss.exe.
The following registry entry is changed to run W32/Bagle-GT on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Debugger
<Windows>\csrss.exe
W32/Bagle-GT then creates the file <Temp>\Message.hta which is a new dropper that will be mailed to email addresses found on the infected computer. This file is also detected as W32/Bagle-GT.
W32/Bagle-GT includes functionality to access the internet and communicate with a remote server via HTTP.