Alias:I-Worm.Sober, W32/Sober.A, Win32/Sober.A, W32/Sober@MM, W32.
Type:Worm 
Size:~63,488 bytes 
Origin:Germany 
Date:10-24-2003 
Damage:Overwrites files 
VDF Version:6.22.00.15 
Danger:Medium 
Distribution:High 

General DescriptionWorm/Sober sends itself directly to the existing email addresses found on the
computer using its own SMTP engine. The subject is in German and the attachment contains files with the extensions: .exe, .pif, .bat, .scr or .com.

SymptomsWhen activating the worm, a false "Error" dialog box appears.

DistributionEmail spreading, using its own SMTP engine and over Kazaa via "My Shared Folder".

Technical DetailsThe worm Sober was developed in Visual Basic 6.0 (German version) and packed with UPX. The UPX header was changed, so the unpacking with traditional methods would be more difficult.

At the first start the worm infects all the executables in "My Shared Folder" where it generally occupies the first position. The worm performs as so called "overwriter" and causes permanent damage to these executables. The purpose of this procedure is the intentional spreading, over file sharing networks, of the data which the worm regularly places in the exchanged files. If the host file is smaller than the worm, then the file will be completely overwritten.

Finally, a false dialog box appears. The worm can hide behind the following filenames:

* SPOOLE.EXE
* WINLOG32.EXE
* HLP16.EXE
* DRIVER.EXE
* SYSTEMCHK.EXE
* WINCHK.EXE
* ANTIV.EXE
* SWCHOST.EXE
* SYSTEMINI.EXE
* DRIVERINI.EXE
* FILEXE.EXE
* SYSHOST.EXE
* DRV.EXE
* EXPOLER.EXE
* WINREG.EXE
* QNAME.EXE
* LSSAS.EXE

The worm generally starts in two instances, which means it runs simultaneously twice in the system. So, if one of the processes is terminated, the other establishes its absence and another procedure is initiated to substitute the finished one. Thus, the user has no chance of terminating the both processes at the same time, using Task Manager.

If one attempts to remove the Auto Start entry of the active worm, it immediately writes itself back into the registry. This behavior is obtained with a Visual Basic Timer Object, which periodically checks the registry for this Autorun entry.

The worm adds itself to the following registry keys, using random names:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

Sober has its own SMTP engine to send itself by email. The subject of the email is randomly chosen from the following list:
"You send spam mails (Worm?)"
"A worm is on your computer!"
"Now, it's enough"
"You have sent me a virus!"
"Hi darling, what are you doing now?"
"Be careful! New mail worm"
"Re: Contact"
"Re: Sex"
"Sorry, I've become your mail"
"Hey man, long not see you"
"Re: lol"
"Viurs blocked every PC (Take care!)"
"Surprise"
"I've become your mail!"
"Advise who I am!"
"New Sobig-Worm variation (please read)"
"Back At The Funny Farm"
"I love you (I'm not a virus!)"
"Neuer Viurs im Umlauf!"
"Sie versenden Spam Mails (Virus?)"
"Ein Wurm ist auf Ihrem Computer!"
"Langsam reicht es mir"
"Sie haben mir einen Wurm geschickt!"
"Hi Schnuckel was machst du so ?"
"VORSICHT!!! Neuer Mail Wurm"
"Re: Kontakt"
"Re: Sex"
"Sorry, Ich habe Ihre Mail bekommen"
"Hi Olle, lange niks mehr geh"
"Re: lol"
"Viurs blockiert jeden PC (Vorsicht!)"
"Überraschung"
"Ich habe Ihre E-Mail bekommen !"
"Jetzt rate mal, wer ich bin !?"
"Neue Sobig Variante (Lesen!!)"
"Back At The Funny Farm"
"Ich Liebe Dich"

Afterwards the worm chooses a random name from the next list and sends itself as attachment by email:
AntiVirusDoc.pif
Check-Patch.bat
Screen_Doku.scr
Removal-Tool.exe
Perversionen.scr
Bild.scr
robot_mail.scr
RobotMailer.com
Privat.exe
AntiTrojan.exe
Mausi.scr
NackiDei.com
Anti-Sob.bat
screen_doc.scr
potency.pif
perversion.scr
pic.scr
CM-Recover.com
playme.exe
robot_mailer.pif
little-scr.scr
security.pif
Funny.scr
Liebe.com
Odin_Worm.exe
anti_virusdoc.pif
check-patch.bat
removal-tool.exe
love.com
nacked.com
Hengst.pif
schnitzel.exe
anti-trojan.exe
NAV.pif

The worm makes also a file named "similare.exe" in Windows system where it gathers the email addresses from the following file types:
htt
rtf
doc
xls
ini
mdb
txt
htm
html
wab
pst
fdb
cfg
ldb
eml
abc
ldif
nab
adp
mdw
mda
mde
ade
sln
dsw
dsp
vap
php
asp
shtml
shtm

It saves these addresses in its own .DLL type file.
Die Beschreibung wurde erstellt von Crony Walker am Dienstag, 15. Juni 2004

zurück . . . .