FRISK Software International


Summary of W32/Sober.O@mm
Alias:W32.Sober.O@mm, Email-Worm.Win32.Sober.p
Length: 53KB
Discovered: 2 May 2005
Definition files: 2 May 2005
Risk Level: High
Distribution:High
 
Jump to:
Brief description
Technical description
Removal Instructions

Brief Description
W32/Sober.O@mm is a mass-mailing worm written in Visual Basic and is around 53KB in size, UPX packed. It sends itself as a zip packed file and can have subject and body text in either German or English.


Technical Description

On startup it displays a phony Winzip error message box:



It then modifies the registry, creating several files on the system, some are used as templates and others are copies of the worm itself.


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinStart"="%system%\Connection Wizard\\Status\\services.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"_WinStart"="%system%\Connection Wizard\\Status\\services.exe"


The worm creates copies of itself in the following directories, also created by the worm:

Duplicate copies of the worm:
%system%\Connection Wizard\Status\csrss.exe
%system%\Connection Wizard\Status\services.exe
%system%\Connection Wizard\Status\smss.exe


The worm also dumps temporary files and templates:
%system%\Connection Wizard\Status\fastso.ber
%system%\adcmmmmq.hjg
%system%\langeinf.lin
%system%\nonrunso.ber
%system%\seppelmx.smx
%system%\xcvfpokd.tqa


Here it stores the e-mail addresses it gathers from the victims computer:
%system%\Connection Wizard\Status\voner1.von
%system%\Connection Wizard\Status\voner2.von
%system%\Connection Wizard\Status\voner3.von


These files are base64 encoded templates of the worm:
%system%\Connection Wizard\Status\packed1.sbr
%system%\Connection Wizard\Status\packed2.sbr
%system%\Connection Wizard\Status\packed3.sbr


The worm stores created e-mail addresses in these files for easy access:
%system%\Connection Wizard\Status\sacri1.ggg
%system%\Connection Wizard\Status\sacri2.ggg
%system%\Connection Wizard\Status\sacri3.ggg



It searches the computer for files that have one of the following substrings in the file name or extension:

pmr phtm stm slk inbox imb csv bak imh xhtml
imm imh cms nws vcf ctl dhtm cgi pp ppt msg
jsp oft vbs uin ldb abc pst cfg mdw mbx mdx
mda adp nab fdb vap dsp ade sln dsw mde frm
bas adr cls ini ldif log mdb xml wsh tbb abx
abd adb pl rtf mmf doc ods nch xls nsf txt
wab eml hlp mht nfo php asp shtml dbx

If a matching file is found it hoards e-mail addresses from it, but does not keep those that have the following substrings in them:

ntp- ntp@ ntp. info@ test@ @www @from. support smtp- @smtp. gold-certs ftp. .dial. .ppp
.anyone subscribe announce @gmetref sql. someone nothing you@ user@ reciver@ somebody
secure whatever@ whoever@ anywhere yourname mustermann@ .kundenserver. mailer-daemon
variabel noreply -dav law2 .sul.t- .qmail@ t-ipconnect t-dialin ipt.aol time freeav @ca.
abuse winrar domain. host. viren bitdefender spybot detection ewido. emsisoft linux google
@foo. winzip @example. bellcore. @arin mozilla iana@ iana- @iana @avp icrosoft. @sophos
@panda @kaspers free-av antivir virus verizon. @ikarus. @nai. @messagelab nlpmail01. clock


There can be both English and German subjects and bodies.

In English:

One of following subjects is used.

Re:
Re: Your Password
Re: Registration Confirmation
Re: Your email was blocked
Re: mailing error


The body can contain the following strings:


Account and Password Information are attached!

Visit: http://www.[random_url]

This is an automatically generated E-Mail Delivery Status Notification.

Mail-Header, Mail-Body and Error Description are attached

Attachment-Scanner: Status OK,
AntiVirus: No Virus found
Server-AntiVirus: No Virus (Clean)


In German:

One of following subjects is used:

Ihr Passwort
Mail-Fehler!
Ihre E-Mail wurde verweigert
Ich bin's, was zum lachen ;)
Glueckwunsch: Ihr WM Ticket
WM Ticket Verlosung
WM-Ticket-Auslosung

The following lines are used to create the mail body:


Passwort und Benutzer-Informationen befinden sich in der beigefuegten Anlage.

Diese E-Mail wurde automatisch erzeugt

Mehr Information finden Sie unter http://www.[random_url]

Folgende Fehler sind aufgetreten:

Fehler konnte nicht Explicit ermittelt werde

Aus Datenschutzrechtlichen Gruenden, muss die vollstaendige E-Mail incl. Daten gezippt & angehaengt werden.

Wir bitten Sie, dieses zu beruecksichtigen.

Nun sieh dir das mal an!

Was ein Ferkel ....

Herzlichen Glueckwunsch

Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.

St. Rainer Gellhaus

--- Pressesprecher Jens Grittner und Gerd Graus
--- FIFA Fussball-Weltmeisterschaft 2006
--- Organisationskomitee Deutschland
--- Tel. 069 / 2006 - 2600
--- Jens.Grittner@ok2006.de
--- Gerd.Graus@ok2006.de

--- FIFA-Pressekontakt:

beim Run auf die begehrten Tickets fnr die 64 Spiele der Weltmeisterschaft 2006 in Deutschland sind Sie dabei.

Mail-Scanner: Es wurde kein Virus festgestellt
AntiVirus: Kein Virus gefunden
AntiVirus-System: Kein Virus erkannt


The attachments are zip packed and come with the following names:

account_info.zip
account_info-text.zip
error-mail_info.zip
LOL.zip
mail_info.zip
our_secret.zip
_PassWort-Info.zip
autoemail-text.zip
okTicket-info.zip
Fifa_Info-Text.zip



Removal Instructions
For general removal instructions please click here.

Ragnar Gisli ”lafsson - Senior Virus Researcher - FSI Virus Research Lab
 


Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:

Authentium

perComp Verlag
(in German)
 

agoat@klaki.net argentina@f-prot.com argentina@frisk.is argentina@complex.is argentina@f-prot.is argentina@frisk-software.com argentina@f-prot.net argentina@f-prot.co.uk brazil@f-prot.com brazil@frisk.is brazil@complex.is brazil@f-prot.is brazil@frisk-software.com brazil@f-prot.net brazil@f-prot.co.uk malta@f-prot.com malta@frisk.is malta@complex.is malta@f-prot.is malta@frisk-software.com malta@f-prot.net malta@f-prot.co.uk a.bjani@f-prot.com a.bjani@frisk.is a.bjani@complex.is a.bjani@f-prot.is a.bjani@f-prot.co.uk a.bjani@frisk-software.com a.bjani@f-prot.net z.fifl@f-prot.com z.fifl@frisk.is z.fifl@complex.is z.fifl@f-prot.is z.fifl@f-prot.co.uk z.fifl@frisk-software.com z.fifl@f-prot.net strumpuri@complex.is strumpure@complex.is strumpuru@complex.is