Threat Description

Email-Worm:​W32/Sober.AA

Details

Aliases:Email-Worm:​W32/Sober.AA
Category:Malware
Type:Email-Worm
Platform:W32

Summary



Sober.AA is a mass mailing worm that uses English and German texts in the e-mails generated by this worm.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



This worm is written in Visual Basic. It is compressed using UPX.

Installation to the System

Upon execution, this worm creates the folder PoolData in the Windows directory. It then creates several copies of itself as follows:

  • csrss.exe
  • services.exe
  • smss.exe

These files are identical to each other with a single byte difference located at offset 0xA0.

This worm also creates the following Registry entries in order to enable its automatic execution upon system start up:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run_WinData = "[Windows directory]\PoolData\services.exe"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWinData = "[Windows directory]\PoolData\services.exe"

Spreading via E-mail messages

Before spreading, this worm scans files with certain extensions on all hard disk drives to harvest e-mail addresses. All files with the following extensions are scanned:

  • abc
  • abd
  • abx
  • adb
  • ade
  • adp
  • adr
  • asp
  • bak
  • bas
  • cfg
  • cgi
  • cls
  • cms
  • csv
  • ctl
  • dbx
  • dhtm
  • doc
  • dsp
  • dsw
  • eml
  • fdb
  • frm
  • hlp
  • imb
  • imh
  • imh
  • imm
  • inbox
  • ini
  • jsp
  • ldb
  • ldif
  • log
  • mbx
  • mda
  • mdb
  • mde
  • mdw
  • mdx
  • mht
  • mmf
  • msg
  • nab
  • nch
  • nfo
  • nsf
  • nws
  • ods
  • oft
  • php
  • phtm
  • pl
  • pmr
  • pp
  • ppt
  • pst
  • rtf
  • shtml
  • slk
  • sln
  • stm
  • tbb
  • txt
  • uin
  • vap
  • vbs
  • vcf
  • wab
  • wsh
  • xhtml
  • xls
  • xml

This worm creates the following files, where the system harvested e-mail addresses are stored:

  • spxttx1.xnt
  • spxttx2.xnt
  • spxttx3.xnt

It can then send e-mails with English and German based text together with a Zip archived copy of itself as an attachment.

It ignores any email addresses that contain any of the following substrings:

  • america.hm
  • arcor.de
  • asia
  • australiamail
  • Avast
  • bluewin.ch
  • cia.gov
  • e-mail.dk
  • F-Secure
  • gmail
  • google
  • heise.de
  • icqmail
  • lycos
  • newyork
  • sophos
  • swissinfo.org
  • trendMicro
  • webmails
  • zonnet.nl

The worm composes the following German messages:

Subject:

  • Ihr Passwort wurde geaendert!

Body:

Ihr Passwort wurde erfolgreich geaendert.
Ihre neuen Account-Daten und Passwort befinden sich gesichert im Anhang!
**-** Web: http://www.[spoofed]
**-** E-Mail: [spoofed]

Attachment:

  • Passw_Data.zip

--- or ---

Subject:

  • Fehlerhafte Mailzustellung

Body:

Diese Nachricht wurde Automatisch generiert.
- Ihre EMail konnte nicht empfangen oder gesendet werden.
- Mail-Text sowie Mail-Header befinden sich im Anhang.
*** auto mailerdaemon XPath 7
*** (c) by [spoofed]

Attachment:

  • Mail_Data.zip

--- or ---

Subject:

  • Ihr Account wurde eingerichtet!

Body:

Danke das Sie sich fuer uns entschieden haben.
Um ihren neuen Account zu aktivieren, folgen sie der kurzen Anleitung im Anhang. 
Es sind nur 2 Schritte noetig!
***** Web: http://www.[spoofed]
***** E-Mail: [spoofed]

Attachment:

  • Anleitung.zip

It also composes the following English messages:

Subject:

  • Your Updated Password!

Body:

You notified us that you have forgotten your password.
We have changed your password to a random sequence of letters and digits!
For more detailed information, see the attached password file ...
**** Web: http://www. [spoofed]
**** eMail: [spoofed]

Attachment:

  • Passw_Data.zip

--- or ---

Subject:

  • Error in your eMail

Body:

Your eMail has occurred an unknown error on our Server.
Please read your mail and check the text.
The full email is attached!
*** auto mailerdaemon X.Path 4.2
*** (c) by [spoofed]

Attachment:

  • Mail_Data.zip

These e-mail messages may appear to come from the following senders:

  • Admin
  • Hostmaster
  • Postmaster
  • Webmaster





SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More