FRISK Software International


Summary of W32/Sobig.A@mm
Length: 65536
Discovered: 9 Jan 2003
Definition files: 9 Jan 2003
Risk Level: Medium
Distribution:Medium
Infection Method:Email attachment, Local area network shares
 
Jump to:
Brief description
Technical description

Brief Description
Sobig.A is written in Visual C++ and packed with the UPX packer. It spreads using email, sending it self as a email attachment, it also replicates through shared network drives.


Technical Description
The worm adds it self to the registry under the following keys where the value is the location of the virus. So that each time you start the computer it runs the virus:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WindowsMGM
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsMGM

It also copies it self to the to windows directory under the name
winmgm32.exe

The worm sends email to all the email addresses it finds in files with theses endings:
.WAB
.DBX
.HML
.HTML
.EML
.TXT

The email is constructed from these parts
The from address is:
big@boss.com

The subject is randomnly chosen from this list
Re: Here is that sample
Re: Document
Re: Sample
Re: Movies

The name of the attached file is chosen from the following lists:
Sample.pif
Untitled1.pif
Document003.pif
Movie_0074.mpeg.pif

The worm also looks for network shares and tries to copy itself to these directories:
Windows\All Users\Start\Menu\Programs\StartUp
Documents and Settings\All Users\Start Menu\Programs\Startup


Sigurdur A. Stefnisson FRISK Software international
 


Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:

Authentium

perComp Verlag
(in German)
 

agoat@klaki.net argentina@f-prot.com argentina@frisk.is argentina@complex.is argentina@f-prot.is argentina@frisk-software.com argentina@f-prot.net argentina@f-prot.co.uk brazil@f-prot.com brazil@frisk.is brazil@complex.is brazil@f-prot.is brazil@frisk-software.com brazil@f-prot.net brazil@f-prot.co.uk malta@f-prot.com malta@frisk.is malta@complex.is malta@f-prot.is malta@frisk-software.com malta@f-prot.net malta@f-prot.co.uk a.bjani@f-prot.com a.bjani@frisk.is a.bjani@complex.is a.bjani@f-prot.is a.bjani@f-prot.co.uk a.bjani@frisk-software.com a.bjani@f-prot.net z.fifl@f-prot.com z.fifl@frisk.is z.fifl@complex.is z.fifl@f-prot.is z.fifl@f-prot.co.uk z.fifl@frisk-software.com z.fifl@f-prot.net strumpuri@complex.is strumpure@complex.is strumpuru@complex.is