Sober.L

Summary

Sober.L worm was seeded in e-mails on 7th of March 2005. It has less functionality than the previous variant, composing a smaller amount of different messages. Sober.L sends itself as an attachment in e-mail messages with English or German texts.

Disinfection & Removal

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Technical Details

The worm is written in Visual Basic. The worm's file is a modified UPX packed PE executable about 45 kilobytes long. The unpacked worm's file size is around 142 kilobytes. The worm adds random garbage to the end of its file every time it installs itself on a computer.

Installation to system

When the worm's file is started it opens Write text editor with the following text as a decoy:

When the worm's file is run, it copies itself as "smss.exe" into the %WinDir%\msagent\system\ folder, created by the worm.

Sober.L worm adds startup keys for "smss.exe" in System Registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 " Services.dll" = "%WinDir%\msagent\system\smss.exe"

Also the worm drops the text file 'read.me' file to Windows folder.

Spreading in E-mails

The worm sends different types of e-mail messages with English and German texts and its file attached. The attachment is a ZIP archive containing the worm's executable.

Before spreading the worm scans files with certain extensions on all hard disks to harvest e-mail addresses. Files with the following extensions are scanned:

pmr
 phtm
 stm
 slk
 inbox
 imb
 csv
 bak
 imh
 xhtml
 imm
 imh
 cms
 nws
 vcf
 ctl
 dhtm
 cgi
 pp
 ppt
 msg
 jsp
 oft
 vbs
 uin
 ldb
 abc
 pst
 cfg
 mdw
 mbx
 mdx
 mda
 adp
 nab
 fdb
 vap
 dsp
 ade
 sln
 dsw
 mde
 frm
 bas
 adr
 cls
 ini
 ldif
 log
 mdb
 xml
 wsh
 tbb
 abx
 abd
 adb
 pl
 rtf
 mmf
 doc
 ods
 nch
 xls
 nsf
 txt
 wab
 eml
 hlp
 mht
 nfo
 php
 asp
 shtml
 dbx

The worm ignores e-mail addresses that contain any of the following substrings:

ntp-
 ntp@
 ntp.
 info@
 test@
 @www
 @from.
 support
 smtp-
 @smtp.
 gold-certs
 ftp.
 .dial.
 .ppp.
 anyone
 subscribe
 announce
 @gmetref
 sql.
 someone
 nothing
 you@
 user@
 reciver@
 somebody
 secure
 whatever@
 whoever@
 anywhere
 yourname
 mustermann@
 .kundenserver.
 mailer-daemon
 variabel
 noreply
 -dav
 law2
 .sul.t-
 .qmail@
 t-ipconnect
 t-dialin
 ipt.aol
 time
 freeav
 @ca.
 abuse
 winrar
 domain.
 host.
 viren
 bitdefender
 spybot
 detection
 ewido.
 emsisoft
 linux
 google
 @foo.
 winzip
 @example.
 bellcore.
 @arin
 mozilla
 iana@
 iana-
 @iana
 @avp
 icrosoft.
 @sophos
 @panda
 @kaspers
 free-av
 antivir
 virus
 verizon.
 @ikarus.
 @nai.
 @messagelab
 nlpmail01.
 clock

The worm composes e-mails with both English and German texts. If the worm sends infected messages to domains with suffixes '.de', '.ch', '.at', '.li' and also to 'gmx.' domain, it composes messages in German, otherwise English messages are composed.

The worm composes the following messages:

Subjects:

Your Password & Account number
 Ich habe Ihre E-Mail bekommen!

Body texts:

i've got an admin mail with a Password and Account info!
 but the mail recipient are you! it's probably an esmtp error, i think.
 i've copied the full mail text in the Windows text-editor & zipped.
 ok, cya...

---- or ----

Hallo,
 jemand schickt ihre privaten Mails auf meinem Account.
 Ich schaetze mal, das es ein Fehler vom Provider ist.
 Insgesamt waren es jetzt schon 6 Mails!
 Ich habe alle Mail-Texte im Texteditor kopiert und gezippt.
 Wenn es doch kein Fehler vom Provider ist, sorge dafuer das diese Dinger nicht mehr auf meinem Account
 landen, es Nervt naemlich.
 Gruss

Attachments:

MailTexte.zip
 acc_text.zip

Detection

Sober.L worm is detected with the following FSAV updates:

Detection Type: PC
Database: 2005-03-07_06

Description Created: Alexey Podrezov & Ero Carrera; March 7th, 2005