Email-Worm:W32/Sober.AA

Classification

Malware

Email-Worm

W32

Email-Worm:W32/Sober.AA

Summary

Sober.AA is a mass mailing worm that uses English and German texts in the emails generated by this worm.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

This worm is written in Visual Basic. It is compressed using UPX.

Installation to the System

Upon execution, this worm creates the folder PoolData in the Windows directory. It then creates several copies of itself as follows:

  • csrss.exe
  • services.exe
  • smss.exe

These files are identical to each other with a single byte difference located at offset 0xA0.

This worm also creates the following Registry entries in order to enable its automatic execution upon system start up:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run_WinData = "[Windows directory]\PoolData\services.exe"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWinData = "[Windows directory]\PoolData\services.exe"

Spreading via email messages

Before spreading, this worm scans files with certain extensions on all hard disk drives to harvest email addresses. All files with the following extensions are scanned:

  • abc
  • abd
  • abx
  • adb
  • ade
  • adp
  • adr
  • asp
  • bak
  • bas
  • cfg
  • cgi
  • cls
  • cms
  • csv
  • ctl
  • dbx
  • dhtm
  • doc
  • dsp
  • dsw
  • eml
  • fdb
  • frm
  • hlp
  • imb
  • imh
  • imh
  • imm
  • inbox
  • ini
  • jsp
  • ldb
  • ldif
  • log
  • mbx
  • mda
  • mdb
  • mde
  • mdw
  • mdx
  • mht
  • mmf
  • msg
  • nab
  • nch
  • nfo
  • nsf
  • nws
  • ods
  • oft
  • php
  • phtm
  • pl
  • pmr
  • pp
  • ppt
  • pst
  • rtf
  • shtml
  • slk
  • sln
  • stm
  • tbb
  • txt
  • uin
  • vap
  • vbs
  • vcf
  • wab
  • wsh
  • xhtml
  • xls
  • xml

This worm creates the following files, where the system harvested email addresses are stored:

  • spxttx1.xnt
  • spxttx2.xnt
  • spxttx3.xnt

It can then send emails with English and German based text together with a Zip archived copy of itself as an attachment.

It ignores any email addresses that contain any of the following substrings:

  • america.hm
  • arcor.de
  • asia
  • australiamail
  • Avast
  • bluewin.ch
  • cia.gov
  • email.dk
  • F-Secure
  • gmail
  • google
  • heise.de
  • icqmail
  • lycos
  • newyork
  • sophos
  • swissinfo.org
  • trendMicro
  • webmails
  • zonnet.nl

The worm composes the following German messages:

Subject:

  • Ihr Passwort wurde geaendert!

Body:

Ihr Passwort wurde erfolgreich geaendert. Ihre neuen Account-Daten und Passwort befinden sich gesichert im Anhang! **-** Web: http://www.[spoofed] **-** email: [spoofed]

Attachment:

  • Passw_Data.zip

--- or ---

Subject:

  • Fehlerhafte Mailzustellung

Body:

Diese Nachricht wurde Automatisch generiert. - Ihre EMail konnte nicht empfangen oder gesendet werden. - Mail-Text sowie Mail-Header befinden sich im Anhang. *** auto mailerdaemon XPath 7 *** (c) by [spoofed]

Attachment:

  • Mail_Data.zip

--- or ---

Subject:

  • Ihr Account wurde eingerichtet!

Body:

Danke das Sie sich fuer uns entschieden haben. Um ihren neuen Account zu aktivieren, folgen sie der kurzen Anleitung im Anhang.
Es sind nur 2 Schritte noetig! ***** Web: http://www.[spoofed] ***** email: [spoofed]

Attachment:

  • Anleitung.zip

It also composes the following English messages:

Subject:

  • Your Updated Password!

Body:

You notified us that you have forgotten your password. We have changed your password to a random sequence of letters and digits! For more detailed information, see the attached password file ... **** Web: http://www. [spoofed] **** eMail: [spoofed]

Attachment:

  • Passw_Data.zip

--- or ---

Subject:

  • Error in your eMail

Body:

Your eMail has occurred an unknown error on our Server. Please read your mail and check the text. The full email is attached! *** auto mailerdaemon X.Path 4.2 *** (c) by [spoofed]

Attachment:

  • Mail_Data.zip

These email messages may appear to come from the following senders:

  • Admin
  • Hostmaster
  • Postmaster
  • Webmaster

Date Created: -

Date Last Modified: -