NEWS FROM THE LAB - Saturday, May 15, 2004

Sober.G is not intended Posted by Alexey @ 21:48 GMT

We got a few reports about Sober.G spreading in the wild. After comparing samples from the worm's messages and the sample that we had originally received and described, we found out that our conclusions about Sober.G being intended were incorrect. It happened because the sample that we originally got was taken from an infected computer's Windows System folder and not from an e-mail message. Sober worm has a "feature" of modifying its executable file that it drops to a hard drive. It changes a byte at offset 0xA0 to 0x60 when its file is installed to a system. However, the file that the worm sends out in e-mail messages has this byte value zeroed. So the sample we originally received did not install itself properly and it did not create MIME-encoded files for spreading because the worm "thought" it was already installed. Failure of the worm to install itself properly and create files necessary for its spreading drove us to the conclusion that the worm was intended. We are sorry for confusion. The description of the worm will be updated shortly.