We have just received yet another variant of WORM BAGLE from our honeypot system and it seems like it is made for the valentines as you will see below. This is actually the bagle’s style to increase its infection rate, its seasonal email contents. It helps the bagle to spread rapidly by the help of its seasonal and convincing email messages. This adds up to bagle’s popularity and good social engineering techniques.

You will see below the sample email of the initial seeding of worm bagle. This is not the actual email that the worm itself uses to propagate but just a spammed email. It has an executable attachment named e-card.exe, which is the copy of the worm.

Other details about the worm

Possible Subjects

• Will You Be My Valentine?
  
• Love you with all my heart!
  
• See you tonight!
  
• Come Be With Me, my Love!
  
• My dream is coming true!

Possible Attachments

• love_me.exe
  
• mplay.exe
  
• love_me_now.exe

Update(JJ, 16 February 2006 00:32:55)

The Bagle author is now quoting Robert Frost’s “Love And A Question” and “To Earthward” (check out the Advisories section for the spammed emails). Here’s one sample:

Yes, i just googled it, i didn’t exactly know it was by Robert Frost the first time :p At least that’s what Google said (disclaimer if ever it’s wrong hwehehe).