Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Email-Worm:W32/Sober.AA


Discovered:
Aliases:


April 07, 2007
Email-Worm:W32/Sober.AA

Malware
Email-Worm
W32

Summary

Sober.AA is a mass mailing worm that uses English and German texts in the e-mails generated by this worm.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

This worm is written in Visual Basic. It is compressed using UPX.


Installation to the System

Upon execution, this worm creates the folder PoolData in the Windows directory. It then creates several copies of itself as follows:

  • csrss.exe
  • services.exe
  • smss.exe

These files are identical to each other with a single byte difference located at offset 0xA0.

This worm also creates the following Registry entries in order to enable its automatic execution upon system start up:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run_WinData = "[Windows directory]\PoolData\services.exe"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWinData = "[Windows directory]\PoolData\services.exe"

Spreading via E-mail messages

Before spreading, this worm scans files with certain extensions on all hard disk drives to harvest e-mail addresses. All files with the following extensions are scanned:

  • abc
  • abd
  • abx
  • adb
  • ade
  • adp
  • adr
  • asp
  • bak
  • bas
  • cfg
  • cgi
  • cls
  • cms
  • csv
  • ctl
  • dbx
  • dhtm
  • doc
  • dsp
  • dsw
  • eml
  • fdb
  • frm
  • hlp
  • imb
  • imh
  • imh
  • imm
  • inbox
  • ini
  • jsp
  • ldb
  • ldif
  • log
  • mbx
  • mda
  • mdb
  • mde
  • mdw
  • mdx
  • mht
  • mmf
  • msg
  • nab
  • nch
  • nfo
  • nsf
  • nws
  • ods
  • oft
  • php
  • phtm
  • pl
  • pmr
  • pp
  • ppt
  • pst
  • rtf
  • shtml
  • slk
  • sln
  • stm
  • tbb
  • txt
  • uin
  • vap
  • vbs
  • vcf
  • wab
  • wsh
  • xhtml
  • xls
  • xml

This worm creates the following files, where the system harvested e-mail addresses are stored:

  • spxttx1.xnt
  • spxttx2.xnt
  • spxttx3.xnt

It can then send e-mails with English and German based text together with a Zip archived copy of itself as an attachment.

It ignores any email addresses that contain any of the following substrings:

  • america.hm
  • arcor.de
  • asia
  • australiamail
  • Avast
  • bluewin.ch
  • cia.gov
  • e-mail.dk
  • F-Secure
  • gmail
  • google
  • heise.de
  • icqmail
  • lycos
  • newyork
  • sophos
  • swissinfo.org
  • trendMicro
  • webmails
  • zonnet.nl

The worm composes the following German messages:

Subject:

  • Ihr Passwort wurde geaendert!

Body:

Ihr Passwort wurde erfolgreich geaendert.
Ihre neuen Account-Daten und Passwort befinden sich gesichert im Anhang!
**-** Web: http://www.[spoofed]
**-** E-Mail: [spoofed]

Attachment:

  • Passw_Data.zip

--- or ---

Subject:

  • Fehlerhafte Mailzustellung

Body:

Diese Nachricht wurde Automatisch generiert.
- Ihre EMail konnte nicht empfangen oder gesendet werden.
- Mail-Text sowie Mail-Header befinden sich im Anhang.
*** auto mailerdaemon XPath 7
*** (c) by [spoofed]

Attachment:

  • Mail_Data.zip

--- or ---

Subject:

  • Ihr Account wurde eingerichtet!

Body:

Danke das Sie sich fuer uns entschieden haben.
Um ihren neuen Account zu aktivieren, folgen sie der kurzen Anleitung im Anhang. 
Es sind nur 2 Schritte noetig!
***** Web: http://www.[spoofed]
***** E-Mail: [spoofed]

Attachment:

  • Anleitung.zip

It also composes the following English messages:

Subject:

  • Your Updated Password!

Body:

You notified us that you have forgotten your password.
We have changed your password to a random sequence of letters and digits!
For more detailed information, see the attached password file ...
**** Web: http://www. [spoofed]
**** eMail: [spoofed]

Attachment:

  • Passw_Data.zip

--- or ---

Subject:

  • Error in your eMail

Body:

Your eMail has occurred an unknown error on our Server.
Please read your mail and check the text.
The full email is attached!
*** auto mailerdaemon X.Path 4.2
*** (c) by [spoofed]

Attachment:

  • Mail_Data.zip

These e-mail messages may appear to come from the following senders:

  • Admin
  • Hostmaster
  • Postmaster
  • Webmaster






Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.