F-Secure Virus Descriptions : Sober.N

 [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 "SystemCheck" = "%WinDir%\Config\system\services.exe"

 [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
 "_SystemCheck" = "%WinDir%\Config\system\services.exe"

The worm also creates the following files to installation folder:

 zipped.wrm
 maddys.xyz

'zipped.wrm' contains base64-encoded worm, used in spreading. 'maddsys.xyz' is used to store email addresses.

The worm also writes the following files to system folder:

 nonrunso.ber
 langeinf.lin
 adcmmmmq.hjg
 xcvfpokd.tqa

These files are used to deactivate previous variants of the worm.

Spreading in E-mails

The worm sends different types of e-mail messages with English and German texts and its file attached. The attachment is a ZIP archive containing the worm's executable.

Before spreading the worm scans files with certain extensions on all hard disks to harvest e-mail addresses. Files with the following extensions are scanned:

 pmr
 phtm
 stm
 slk
 inbox
 imb
 csv
 bak
 imh
 xhtml
 imm
 imh
 cms
 nws
 vcf
 ctl
 dhtm
 cgi
 pp
 ppt
 msg
 jsp
 oft
 vbs
 uin
 ldb
 abc
 pst
 cfg
 mdw
 mbx
 mdx
 mda
 adp
 nab
 fdb
 vap
 dsp
 ade
 sln
 dsw
 mde
 frm
 bas
 adr
 cls
 ini
 ldif
 log
 mdb
 xml
 wsh
 tbb
 abx
 abd
 adb
 pl
 rtf
 mmf
 doc
 ods
 nch
 xls
 nsf
 txt
 wab
 eml
 hlp
 mht
 nfo
 php
 asp
 shtml
 dbx

The worm ignores e-mail addresses that contain any of the following substrings:

 @www
 @from.
 smtp-
 @smtp.
 ftp.
 .dial.
 .ppp.
 anyone
 @gmetref
 sql.
 someone
 nothing
 you@
 user@
 reciver@
 somebody
 secure
 whatever@
 whoever@
 anywhere
 yourname
 mustermann@
 mailer-daemon
 variabel
 noreply
 -dav
 law2
 .qmail@
 freeav
 @ca.
 abuse
 winrar
 domain.
 host.
 viren
 bitdefender
 spybot
 detection
 ewido.
 emsisoft
 linux
 @foo.
 winzip
 @example.
 bellcore.
 @arin
 @iana
 @avp
 icrosoft.
 @sophos
 @panda
 @kaspers
 free-av
 antivir
 virus
 verizon.
 @ikarus.
 @nai.
 @messagelab
 nlpmail01.
 clock

The worm composes e-mails with both English and German texts. If the worm sends infected messages to domains with suffixes '.de', '.ch', '.at', '.li' and also to 'gmx.' domain, it composes messages in German, otherwise English messages are composed.

The worm composes the following messages:

Subjects:

 I've_got your EMail on my_account!
 FwD: Ich bin's nochmal

Body texts:

 Hello,
 First, Very Sorry for my bad English.
 Someone is sending your private e-mails on my address.
 It's probably an e-mail provider error!
 At time, I've got over 10 mails on my account, but the recipient are you.
 I have copied all the mail text in the windows text-editor for you & zipped then.
 Make sure, that this mails don't come in my mail-box again.
 bye

 Verdammt,,,,
 ich hatte vergessen Dir meinen Text mitzuschicken.
 Aber bitte nicht woanders darueber Reden, ich wuerde mich dann zu Tode blamieren!
 Ich melde mich.
 Bis bald ;)

Attachments:

 your_text.zip
 Private-Texte.zip

The actual worm executable name inside the attachement is 'mail.document.Datex-packed.exe'.

Back to the Top

Detection

Sober.N worm is detected with the following FSAV updates:

Version=2005-04-19_01

Back to the Top

Updated: Jarkko Turkulainen; April 20th, 2005;

Write-up by: Mikko Hypponen; April 19th, 2005;

Technical Details: Jarkko Turkulainen; April 19th, 2005;

F-Secure Corporation