| ID | X0001 |
| Aliases | None |
| Platforms | Windows |
| Year | 2004 |
| Associated ATT&CK Software | None |
A mass-mailing computer worm affecting Microsoft Windows. [1]
| Name | Use |
|---|---|
| Persistence::Registry Run Keys / Startup Folder (F0012) | Malware adds registry keys to enable its automatic execution at every system startup. [1] |
| Name | Use |
|---|---|
| Execution::Prevent Concurrent Execution (B0024) | Some Bagle variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [1] |
| Execution::Send Email (B0020) | Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [2] |
| Data::Decompress Data::aPLib (C0025.003) | Bagle decompresses data using aPLib. [4] |
SHA256 Hashes
- a1b08bc8fd95d6f7415a9394bf76abed3e7860a5eda380cb863ab2d5fc6b65a5
- e3711dc2049c37e14449066450da86ca1c9a96fecdadbb3ed9d594564b5a829e
[1] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/WORM_BAGLE.U/
[2] https://en.wikipedia.org/wiki/Bagle_(computer_worm)
[3] https://www.joesandbox.com/analysis/561298/0/html
[4] capa v4.0, analyzed at MITRE on 10/12/2022