Skip to main content

Email-Worm:W32/Sober.V

Classification

Category:

Malware

Aliases:

  • Sober.V
  • Email-Worm.Win32.Sober.v
  • W32/Sober.V@mm

Summary

The Sober.V worm was found on November 15th, 2005. This Sober variant is similar to Sober.T, that appeared yesterday:

https://www.f-secure.com/v-descs/sober_t.shtml

Like the previous variants, this one sends itself inside a ZIP archive as an attachment in email messages with English or German texts. We also received several different droppers for this worm variant. They were apparently created by the worm author manually. They are all detected as 'Sober.v'.

Removal

Technical Details

This Sober variant sends a bit different email messages:

Subject:

Hi, Ich bin's

Body:

Hier ist die Liste die du haben wolltest. Du solltest dich aber auch eintragen! OK, bis dann

Attachment name starts with:

Liste

---- OR ----

Subject:

Thanks for your registration

Body:

Thanks for your registration! We have received your payment. For more detailed information, read the attached text.

Attachment:

reg_text.zip

Protect your devices from malware with F‑Secure Total

Protecting your devices from malicious software is essential for maintaining online security. F‑Secure Total makes this easy, helping you to secure your devices in a brilliantly simple way.

  • Award‑winning antivirus and malware protection

  • Online browsing, banking, and shopping protection

  • 24/7 online identity and data breach monitoring

  • Unlimited VPN service to safe­guard your privacy

  • Password manager with private data protection

Choose how many devices you want to protect to get started.

  • Free customer support

  • Cancel anytime

  • The trial does not obligate you to buy the product

After 30 days your subscription will renew automatically for one year at €69.99.

More Support

Community

Ask questions in our Community.

User guides

Check the user guide for instructions.

Contact Support

Chat with with or call an agent.

Submit a Sample

Submit a file or URL for analysis.