I-Worm.Sober
Sober is a network worm that spreads via email in message file attachments. It is written in Visual Basic and is 63KB in size. The file is compressed by UPX.
Infected email messages have arbitrary subjects and body texts in English and German. The name of the file attachment can vary with different file extensions - .bat, .com, .exe, .pif, .scr
Exmaples:
Subject: New Sobig-Worm variation (please read)
Body text: New Sobig variation in the net.
You must change any settings before the worm control your computer!
But, read the official statement from Norton Anti Virus!
File attachment: NAV.pif
Installing
The Sober worm only become active if a user opens the file attachment. Upon being launched the Sober network worm displays on the screen a false error message:
It then creates three copies of itself in the system's Windows directory
using the following names:
similare.exe
systemchk.exe
winrea.exe
Next, Sober registers itself in the system registry's auto-run key:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
syspath=%System%\drv.exe
Spreading
Sober searches for files that have one of the following file extensions:
htt
rtf
doc
xls
ini
mdb
txt
htm
html
wab
pst
fdb
cfg
ldb
eml
abc
ldif
nab
adp
mdw
mda
mde
ade
sln
dsw
dsp
vap
php
asp
shtml
shtm
In these files, Sober searches for victim email addresses with which to send itself to. Sober uses a direct connection to the SMTP server.
Infected message subjects are chosen at random from the following
list:
"You send spam mails (Worm?)"
"A worm is on your computer!"
"Now, it's enough"
"You have sent me a virus!"
"Hi darling, what are you doing now?"
"Be careful! New mail worm"
"Re: Contact"
"RE: Sex"
"Sorry, I've become your mail"
"Hey man, long not see you"
"Re: lol"
"Viurs blocked every PC (Take care!)"
"Surprise"
"I've become your mail!"
"Advise who I am!"
"New Sobig-Worm variation (please read)"
"Back At The Funny Farm"
"I love you (I'm not a virus!)"
"Neuer Virus im Umlauf!"
"Sie versenden Spam Mails (Virus?)"
"Ein Wurm ist auf Ihrem Computer!"
"Langsam reicht es mir"
"Sie haben mir einen Wurm geschickt!"
"Hi Schnuckel was machst du so ?"
"VORSICHT!!! Neuer Mail Wurm"
"Re: Kontakt"
"RE: Sex"
"Sorry, Ich habe Ihre Mail bekommen"
"Hi Olle, lange niks mehr geh"
"Re: lol"
"Viurs blockiert jeden PC (Vorsicht!)"
"_berraschung"
"Ich habe Ihre E-Mail bekommen !"
"Jetzt rate mal, wer ich bin !?"
"Neue Sobig Variante (Lesen!!)"
"Back At The Funny Farm"
"Ich Liebe Dich"
The file attachment is chosen from the following list (the following
list is not comprehensive):
AntiVirusDoc.pif
Check-Patch.bat
Screen_Doku.scr
Removal-Tool.exe
Perversionen.scr
Bild.scr
robot_mail.scr
RobotMailer.com
Privat.exe
AntiTrojan.exe
Mausi.scr
NackiDei.com
Anti-Sob.bat
screen_doc.scr
potency.pif
perversion.scr
pic.scr
CM-Recover.com
playme.exe
robot_mailer.pif
little-scr.scr
security.pif
Funny.scr
Liebe.com
Odin_Worm.exe
anti_virusdoc.pif
check-patch.bat
removal-tool.exe
love.com
nacked.com
Hengst.pif
schnitzel.exe
anti-trojan.exe
NAV.pif
Infected messages normally have the following signature:
Automatic Mail notification: Robot-System__#"
Other details
The Sober worm contains the following text strings:
Programmer of the -Sobig Worm-
Congratulations!! Your Sobig Worms are
very good!!!
You are a very good programmer!
Yours faithfully
Odin alias Anon
Odin_Worm.exe
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5) THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
281003/090904
