Worm/Sober.Y - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Sober.Y
CME number:	681
Date discovered:	15/11/2005
Type:	Worm
In the wild:	Yes
Reported Infections:	High
Distribution Potential:	Medium
Damage Potential:	Medium
Static file:	Yes
File size:	55.390 Bytes
MD5 checksum:	cb73f0c6d0a20e191c21cc47dff1e471
VDF version:	6.32.00.180 - Tue, 15 Nov 2005 10:42 (GMT+1)
Heuristic:	Worm/Sober.Gen

General Method of propagation:
   • Email

Aliases:
   • Mcafee: W32/Sober
   • Kaspersky: Email-Worm.Win32.Sober.y
   • Sophos: W32/Sober-Z
   • Grisoft: I-Worm/Sober.CF
   • VirusBuster: iworm I-Worm.Sober.AI
   • Bitdefender: Win32.Sober.AD@mm

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Uses its own Email engine
   • Registry modification

Right after execution the following information is displayed:

Files It copies itself to the following locations:
   • %WINDIR%\WinSecurity\services.exe
   • %WINDIR%\WinSecurity\smss.exe
   • %WINDIR%\WinSecurity\csrss.exe

The following files are created:

– Non malicious files:
   • %WINDIR%\WinSecurity\starter.run
   • %WINDIR%\WinSecurity\nexttroj.tro

– MIME encoded copies of itself:
   • %WINDIR%\WinSecurity\socket1.ifo
   • %WINDIR%\WinSecurity\socket2.ifo
   • %WINDIR%\WinSecurity\socket3.ifo

– Files that contain collected email addresses:
   • %WINDIR%\WinSecurity\mssock1.dli
   • %WINDIR%\WinSecurity\mssock2.dli
   • %WINDIR%\WinSecurity\mssock3.dli
   • %WINDIR%\WinSecurity\winmem1.ory
   • %WINDIR%\WinSecurity\winmem2.ory
   • %WINDIR%\WinSecurity\ winmem3.ory

– Files in order to deactivate previous versions of itself:
   • %SYSDIR%\bbvmwxxf.hml
   • %SYSDIR%\langeinf.lin
   • %SYSDIR%\nonrunso.ber
   • %SYSDIR%\rubezahl.rub
   • %SYSDIR%\filesms.fms
   • %SYSDIR%\runstop.rst

It tries to download a file:

The built-in time synchronisation via the NTP protocol will trigger on the following point of time:
Date: 06/01/2006
Time: 00:00 UTC (Universal Time Coordinated)

The list of the URLs changes according to the following interval: 14 days

– The locations are the following:
   • free.pages.at/emcndvwoemn/**********
   • home.arcor.de/dixqshv/**********
   • home.arcor.de/jmqnqgijmng/**********
   • home.arcor.de/nhirmvtg/**********
   • home.arcor.de/ocllceclbhs/**********
   • home.arcor.de/srvziadzvzr/**********
   • home.pages.at/npgwtjgxwthx/**********
   • people.freenet.de/fseqepagqfphv/**********
   • people.freenet.de/mclvompycem/**********
   • people.freenet.de/qisezhin/**********
   • people.freenet.de/smtmeihf/**********
   • people.freenet.de/urfiqileuq/**********
   • people.freenet.de/wjpropqmlpohj/**********
   • people.freenet.de/zmnjgmomgbdz/**********
   • scifi.pages.at/zzzvmkituktgr/**********
At the time of writing this file was not online for further investigation.

Registry The following registry keys are added in order to run the processes after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "Windows"="%WINDIR%\WinSecurity\services.exe"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• "_Windows"="%WINDIR%\WinSecurity\services.exe"

Email It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:

Trigger conditions:
According to the time obtained via the NTP protocol it will start the mailing routine.
– Date: 21/11/2005
– Time: 7 PM (GMT)

From:
The sender address is spoofed.
Generated addresses. Please do not assume that it was the sender's intention to send this email to you. He might not know about his infection or might not even be infected at all. Furthermore it is possible that you will receive bounced emails telling you that you are infected. This might also not be the case.

To:
– Email addresses found in specific files on the system.
– Email addresses gathered from WAB (Windows Address Book)
– Generated addresses

Subject:
One of the following:
   • Account Information; Account_Information; Ermittlungsverfahren wurde
      eingeleitet; Ermittlungsverfahren_wurde_eingeleitet; hi, ive a new
      mail address; hi,_ive_a_new_mail_address; Ihr Passwort; Ihr_Passwort;
      Mail delivery failed; Mail_delivery_failed; Mailzustellung wurde
      unterbrochen; Mailzustellung_wurde_unterbrochen; Paris Hilton & Nicole
      Richie; Paris_Hilton_&_Nicole_Richie; Registration Confirmation;
      Registration_Confirmation; RTL: Wer wird Millionaer;
      RTL:_Wer_wird_Millionaer; Sehr geehrter Ebay-Kunde;
      Sehr_geehrter_Ebay-Kunde; Sie besitzen Raubkopien;
      Sie_besitzen_Raubkopien; smtp mail failed; SMTP Mail gescheitert;
      smtp_mail_failed; SMTP_Mail_gescheitert; You visit illegal websites;
      You_visit_illegal_websites; Your IP was logged; Your Password;
      Your_IP_was_logged; Your_Password

Body:
The body of the email is one of the following:

   • Bei uns wurde ein neues Benutzerkonto mit dem Namen "%random character string%" beantragt.
     Um das Konto einzurichten, benoetigen wir eine Bestaetigung, dass die bei der Anmeldung angegebene e-Mail-Adresse stimmt.
     Bitte senden Sie zur Bestaetigung den ausgefuellten Anhang an uns zurueck.

     Wir richten Ihr Benutzerkonto gleich nach Einlangen der Bestaetigung ein und verstaendigen Sie dann per e-Mail, sobald Sie Ihr Konto benutzen koennen.

     Vielen Dank,

     Ihr Ebay-Team

   • Sehr geehrte Dame, sehr geehrter Herr,

     das Herunterladen von Filmen, Software und MP3s ist illegal und somit strafbar.
     Wir moechten Ihnen hiermit vorab mitteilen, dass Ihr Rechner unter der IP %IP address% erfasst wurde. Der Inhalt Ihres Rechner wurde als Beweismittel sichergestellt und es wird ein Ermittlungsverfahren gegen Sie eingleitet.

     Die Strafanzeige und die Moeglichkeit zur Stellungnahme wird Ihnen in den naechsten Tagen schriftlich zugestellt.
     Aktenzeichen NR.:
     %four-digit random character string% (siehe Anhang)

     Hochachtungsvoll
     i.A. Juergen Stock

     --- Bundeskriminalamt BKA
     --- Referat LS 2
     --- 65173 Wiesbaden
     --- Tel.: +49 (0)611 - 55 - 12331 oder
     --- Tel.: +49 (0)611 - 55 - 0

   • Ihre Nutzungsdaten wurden erfolgreich geaendert. Details entnehmen Sie bitte dem Anhang.

     *** http://www.%sender's domain name from email address%
     *** E-Mail: PassAdmin@%sender's domain name from email address%

   • Glueckwunsch: Bei unserer EMail Auslosung hatten Sie und weitere neun Kandidaten Glueck.
     Sie sitzen demnaechst bei Guenther Jauch im Studio!
     Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.

     +++ RTL interactive GmbH
     +++ Geschaeftsfuehrung: Dr. Constantin Lange
     +++ Am Coloneum 1
     +++ 50829 Koeln
     +++ Fon: +49(0) 221-780 0 oder
     +++ Fon: +49 (0) 180 5 44 66 99

   • Dear Sir/Madam,

     we have logged your IP-address on more than 30 illegal Websites.

     Important:
     Please answer our questions!
     The list of questions are attached.

     Yours faithfully,
     Steven Allison

     *** Federal Bureau of Investigation -FBI-
     *** 935 Pennsylvania Avenue, NW, Room 3220
     *** Washington, DC 20535
     *** phone: (202) 324-3000

   • hey its me, my old address dont work at time. i dont know why?!
     in the last days ive got some mails. i' think thaz your mails but im not sure!

     plz read and check ...
     cyaaaaaaa

   • The Simple Life:

     View Paris Hilton & Nicole Richie video clips , pictures & more ;)
     Download is free until Jan, 2006!

     Please use our Download manager.

   • Account and Password Information are attached!

     ***** Go to: http://www.%sender's domain name from email address%
     ***** Email: postman@%sender's domain name from email address%

   • This is an automatically generated Delivery Status Notification.

     SMTP_Error []
     I'm afraid I wasn't able to deliver your message.
     This is a permanent error; I've given up. Sorry it didn't work out.

     The full mail-text and header is attached!

   • Protected message is attached!


     ***** Go to: http://www.%sender's domain name from email address%
     ***** Email: postman@%sender's domain name from email address%

Attachment:
The filenames of the attachments is constructed out of the following:

– It may begin with one of the following:
   • Admin
   • Akte
   • Anzeige
   • Auslosung
   • BKA
   • BKA.Bund
   • Casting
   • downloadm
   • Download
   • Ebay
   • Ebay-User_RegC
   • Ebay-User%several random numbers from 0 to 9%_RegC
   • Email
   • Gewinn
   • Hostmaster
   • Kandidat
   • Info
   • Internet
   • list
   • mail
   • mailtext
   • question_list
   • Post
   • Postman
   • Postmaster
   • reg_pass
   • RTL-Admin
   • RTL
   • RTL-TV
   • Service
   • Webmaster
   • WWM
   • %random character string%
   • %stolen information%

Sometimes continued by one of the following:
   • _body
   • -data
   • -TextInfo
   • _text
   • _Text
   • %random character string%

    The file extension is one of the following:
   • zip

The attachment is a copy of the malware itself.

The email looks like the following:

Mailing Search addresses:
It searches the following files for email addresses:
   • abc; abd; abx; adb; ade; adp; adr; asp; bak; bas; cfg; cgi; cls; cms;
      csv; ctl; dbx; dhtm; doc; dsp; dsw; eml; fdb; frm; hlp; imb; imh; imh;
      imm; inbox; ini; jsp; ldb; ldif; log; mbx; mda; mdb; mde; mdw; mdx;
      mht; mmf; msg; nab; nch; nfo; nsf; nws; ods; oft; php; pl; pmr; pp;
      ppt; pst; rtf; shtml; slk; sln; stm; tbb; txt; uin; vap; vbs; vcf;
      wab; wsh; xhtml; xls; xml

Address generation for FROM field:
To generate addresses it uses the following strings:
   • Admin; Anzeige; Auslosung; BKA; BKA.Bund; Casting; Department;
      Downloads; Gewinn; Hostmaster; hostmaster; info; Info; Internet;
      Kandidat; Mail; office; Post; Postman; RTL; RTL-TV; RTL-Admin;
      Service; webmaster; WWM

It combines this with domains from the following list or from addresses found in files on the system

The domain is one of the following:
   • BKA.de
   • bka.bund.de
   • cia.gov
   • fbi.gov
   • RTL.de
   • RTLWorld.de
   • Ebay.com

Address generation for TO field:
To generate addresses it uses the following strings:
   • address; email; emailserv; e-user; ex-smtp; listening; MailIn_Box;
      mailingbox; mailserver; priv-mail; RAR.regsite; smntp; ThisAccount;
      x_mail-list; XFreeMail; XPost; x-Recipient; Z-Account; zfreemailer;
      Z-User

It may combine the first string with the following:
   • %several random numbers from 0 to 9%

It combines this with domains from the following list or from addresses found in files on the system

The domain is one of the following:
   • security.nl; google.com; yahoo.com; heise.de; hotmail.com;
      microsoft.com; t-online.de; arcor.de; fbi.gov; cia.gov; blueWin.ch;
      msdn.microsoft.com; aol.com; ragnarokonline.com; symantec.com;
      icq.com; ibm.com; yahoo.de; hotmail.de; gmx.de; gmx.at; gmx.net;
      gmx.ch

Avoid addresses:
It does not send emails to addresses containing one of the following strings:
   • ntp-; ntp.; ntp@; test@; @www; @from.; support; smtp-; @smtp.;
      gold-certs; ftp.; .dial.; .ppp.; anyone; subscribe; announce;
      @gmetref; sql.; someone; nothing; you@; user@; reciver@; somebody;
      secure; whatever; whoever; anywhere; yourname; mustermann;
      .kundenserver.; mailer-daemon; variabel; norepl; -dav; law; .sul.t-;
      .qmail; t-ipconnect; t-dialin; ipt.aol; time; freeav; @ca.; abuse;
      winrar; domain.; host.; viren; bitdefender; spybot; detection; ewido.;
      emsisoft; linux; google; @foo.; winzip; @example.; bellcore.; @arin;
      mozilla; iana; iana-; @iana; @avp; icrosoft.; @sophos; @panda;
      @kaspers; free-av; antivir; virus; verizon.; @ikarus.; @nai.;
      @messagelab; nlpmail01.; clock; sender; youremail; home.com;
      hostmaster; postmaster

MX Server:
It has the ability to contact one of the following MX servers:
   • auth.smtp.kundenserver.de; cat.asw.cz; Command.com;
      eforward5.name-services.com; etrn.nextra.cz; excu-mxib-1.symantec.com;
      gold.internet-media.net; group-4.is-rvk.aves.F-Prot.com;
      gsmtp171.google.com; gsmtp57.google.com; icq-mr1.icq.com;
      in1.smtp.messagingengine.com; inbound.canada.com.criticalpath.net;
      INBOUND.HAURI.COM.NETSOLMAIL.net; lycos-com.mr.outblaze.com;
      mail.arcor.de; mail.cambridge.com; mail.DrWeb.com; mail.freeav.de;
      mail.postman.net; mail.softhome.net; mail1.Sophos.com;
      maila.microsoft.com; mailhost.ip-plus.net; mail-kr.bigfoot.com;
      mg1.w-o-r-l-d.net; mx.arcor.de; mx.freenet.de; mx.nyc.untd.com;
      mx0.gmx.de; mx0.gmx.net; mx1.F-Secure.com; mx1.icq.mail2world.com;
      mx1.mail.yahoo.com; mxbw.bluewin.ch; mx-ha01.web.de; mxiab.bluewin.ch;
      mxzhh.bluewin.ch; norman.norman.no; post.strato.de;
      redir-mail-telehouse1.gandi.net; relay.clara.net; relay.heise.de;
      relay2.ucia.gov; scanlab01.mymailwall.at; sitemail2.everyone.net;
      smtp.1und1.de; smtp.ameritech.yahoo.com; smtp.aol.com;
      smtp.compuserve.de; smtp.gmail.com; smtp.googlemail.com;
      smtp.isp.netscape.com; smtp.lycos.de; smtp.mail.ru;
      smtp.mail.yahoo.co.uk; smtp.mail.yahoo.com; smtp.sbcglobal.yahoo.com;
      smtp.web.de; smtp00.fbi.gov; smtp1.google.com; smtpauth.bluewin.ch;
      smtpauth.earthlink.net; sncwsrelay1.nai.com; tombrider.ealaddin.com;
      udcmail01.udc.TrendMicro.com

Resolving server names:
It has the ability to contact the following DNS servers:
   • 204.127.160.3; 70.85.116.133; 204.60.0.3; 67.18.208.130; 69.93.9.167;
      65.98.70.107; 70.85.209.148; 70.84.250.212; 213.218.170.6;
      193.174.26.133; 203.178.136.36; 128.8.74.2; 194.87.0.9; 147.28.0.39;
      194.231.195.79; 69.20.54.201; 198.87.87.38; 194.206.126.200;
      209.68.63.250; 205.166.226.38; 128.83.139.9; 131.215.254.100;
      128.9.176.32; 216.194.225.70; 128.135.5.5; 219.127.89.34;
      193.158.124.143; 129.115.102.150; 38.9.211.2; 134.94.80.2;
      130.149.2.12; 131.215.254.100; 128.194.254.2; 4.2.2.3;
      195.185.185.195; 209.68.2.46; 129.186.1.200; 198.6.1.2; 131.243.64.3;
      24.93.40.33; 195.182.96.29; 158.43.128.1; 200.74.214.246;
      204.117.214.10; 194.25.2.129; 217.237.150.225; 217.237.151.161;
      151.201.0.39; 209.253.113.2; 213.239.234.108; 62.156.146.242;
      207.69.188.186; 207.217.120.43; 129.187.10.25; 200.52.83.103;
      129.187.16.1; 212.242.88.2

Process termination The following process is terminated:
   • mrt.exe

Processes with one of the following strings are terminated:
   • microsoftanti; gcas; gcip; giantanti; inetupd.; nod32kui; nod32.;
      fxsbr; avwin.; guardgui.; aswclnr; stinger; hijack; sober; brfix;
      s_t_i_n; s-t-i-n

After process termination a window is displayed:

Miscellaneous Time synchronisation:
In order to synchronize the local time it contacts NTP servers on port 37:
   • ntps1-1.uni-erlangen.de; time.mit.edu; tick.greyware.com;
      tock.keso.fi; ntp2c.mcc.ac.uk; ntp1.theremailer.net; time.chu.nrc.ca;
      time-a.timefreq.bldrdoc.gov; time.nrc.ca; ntp.massayonet.com.br;
      ntp2b.mcc.ac.uk; ntp2.ien.it; nist1.datum.com; swisstime.ethz.ch;
      clock.psu.edu; time.ien.it; ptbtime2.ptb.de; Rolex.PeachNet.edu;
      ntp.metas.ch; ntp3.fau.de; utcnist.colorado.edu; sundial.columbia.edu;
      vega.cbk.po nan.pl; ntp0.cornell.edu; ntp-sop.inria.fr; rolex.usg.edu;
      time.xmission.com; st.ntp.carnet.hr; ntp-1.ece.cmu.edu; time.nist.gov;
      ntp.lth.se; cuckoo.nevada.edu; ntp-2.ece.cmu.edu; time.kfki.hu;
      ntp.pads.ufrj.br; time-ext.missouri.edu; ntp1.arnes.si;
      timelord.uregina.ca; gandalf.theunixman.com

File patching:
In order to increase the number of maximum connections it has the capability to modify the tcpip.sys. It may result in a corruption of that file and break network connectivity.

File details Programming language:
The malware program was written in Visual Basic.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX

See a brief description here.

Description inserted by Oliver Auerbach on Tue, 22 Nov 2005 12:05 (GMT+1)
Description updated by Iulia Diaconescu on Mon, 12 Dec 2005 13:44 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back