FRISK Software International


Summary of W32/Sobig.F@mm
Length: 70KB
Risk Level: High
Distribution:High
 
Jump to:
Brief description
Technical description

Brief Description

A new variant of Sobig, known as Sobig.F was first found on August 19th, 2003 and it is spreading in the wild.



Technical Description

The executable has a size of around 70KB and it's packed with TELock. It has its own SMTP engine, apart from routines to query directly DNS servers and make requests using the Network Time Protocol.

The worm also has updating capabilities. It will attempt to download updated versions when certain conditions are met.

Deactivation routine

The worm will stop spreading on 10th of September 2003. From this date onwards the worm will exit immediately when executed.

Infection

It will install itself into:

%windir%\winppr32.exe

Proceeding then to add the following keys to the Windows Registry:

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TrayX" = %windir%\winppr32.exe /sinc

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TrayX" = %windir%\winppr32.exe /sinc

So it's started when Windows does.

Mail spreading

The worm usually arrives in e-mails with the following characteristics:

From:

The 'From:' field is filled with an address found from the infected system.
If no address is found, it will use "admin@internet.com"

To:

The 'To:' field is filled with an address found from the infected system.

Subject, any from the list:

Re: Thank you!
 Thank you!
 Your details
 Re: Details
 Re: Re: My details
 Re: Approved
 Re: Your application
 Re: Wicked screensaver
 Re: That movie 

Body, it chooses one from the two following lines:

See the attached file for details
Please see the attached file for details.

Attachment name

The name is selected from the following list:

 your_document.pif
 document_all.pif
 thank_you.pif
 your_details.pif
 details.pif
 document_9446.pif
 application.pif
 wicked_scr.scr
 movie0045.pif

Detection

W32/Sobig.F@mm is detected by the latest version of F-Prot Antivirus using virus signature files dated 19 August 2003 or later.



[Description: Ero Carrera, F-Secure; 19th of August, 2003]
 


Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:

Authentium

perComp Verlag
(in German)
 

agoat@klaki.net argentina@f-prot.com argentina@frisk.is argentina@complex.is argentina@f-prot.is argentina@frisk-software.com argentina@f-prot.net argentina@f-prot.co.uk brazil@f-prot.com brazil@frisk.is brazil@complex.is brazil@f-prot.is brazil@frisk-software.com brazil@f-prot.net brazil@f-prot.co.uk malta@f-prot.com malta@frisk.is malta@complex.is malta@f-prot.is malta@frisk-software.com malta@f-prot.net malta@f-prot.co.uk a.bjani@f-prot.com a.bjani@frisk.is a.bjani@complex.is a.bjani@f-prot.is a.bjani@f-prot.co.uk a.bjani@frisk-software.com a.bjani@f-prot.net z.fifl@f-prot.com z.fifl@frisk.is z.fifl@complex.is z.fifl@f-prot.is z.fifl@f-prot.co.uk z.fifl@frisk-software.com z.fifl@f-prot.net strumpuri@complex.is strumpure@complex.is strumpuru@complex.is