high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | June 2007 (4.18) |
| Protection available since | 22 November 2005 01:13:08 (GMT) |
| Last updated | 9 May 2007 21:06:38 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
If you are running Sophos Anti-Virus for Windows, version 6.0, you should follow our instructions for removing worms.
If you use any of our other products please read the instructions for removing W32/Sober-Z.
More Information
W32/Sober-Z is a worm for the Windows platform.
W32/Sober-Z sends itself as an email attachment to addresses found in files on the hard disk.
Emails messages sent by the worm take one of the following forms. Subject lines may vary by having spaces replaced by underscore ('_') characters.
From: <Harvested address>
Subject: hi, ive a new mail address
Message text:
hey its me, my old address dont work at time. i dont know why?!
in the last days ive got some mails. i' think thaz your mails but im not sure!
plz read and check ...
cyaaaaaaa
Attachment: mailtext.zip
From: <random name>@Ebay.com
Subject: Sehr geehrter Ebay-Kunde
Message text:
Bei uns wurde ein neues Benutzerkonto mit dem Namen "<random username>" beantragt.
Um das Konto einzurichten, benoetigen wir eine Bestaetigung, dass die bei der Anmeldung angegebene e-Mail-Adresse stimmt.
Bitte senden Sie zur Bestaetigung den ausgefuellten Anhang an uns zurueck.
Wir richten Ihr Benutzerkonto gleich nach Einlangen der Bestaetigung ein und verstaendigen Sie dann per e-Mail, sobald Sie Ihr Konto benutzen koennen.
Vielen Dank,
Ihr Ebay-Team
Attachment: Ebay-User<random number>_RegC.zip
From: <random name>@BKA.de OR <random name>@bka.bund.de
Subject chosen from the following:
Ermittlungsverfahren wurde eingeleitet
Sie besitzen Raubkopien
Message text:
Sehr geehrte Dame, sehr geehrter Herr,
das Herunterladen von Filmen, Software und MP3s ist illegal und somit strafbar.
Wir moechten Ihnen hiermit vorab mitteilen, dass Ihr Rechner unter der IP <IP address> erfasst wurde. Der Inhalt Ihres Rechner wurde als Beweismittel sichergestellt und es wird ein Ermittlungsverfahren gegen Sie eingleitet.
Die Strafanzeige und die Moeglichkeit zur Stellungnahme wird Ihnen in den naechsten Tagen schriftlich zugestellt.
Aktenzeichen NR.:#<random number> (siehe Anhang)
Hochachtungsvoll
i.A. Juergen Stock
--- Bundeskriminalamt BKA
--- Referat LS 2
--- 65173 Wiesbaden
--- Tel.: +49 (0)611 - 55 - 12331 oder
--- Tel.: +49 (0)611 - 55 - 0
Attachment: Akte<random number>.zip
From: <harvested address>
Subject chosen from the following:
Account Information
Ihr Passwort
Message text:
Ihre Nutzungsdaten wurden erfolgreich geaendert. Details entnehmen Sie bitte dem Anhang.
*** http://www.<harvested domain>
*** E-Mail: PassAdmin@<harvested domain>
Attachment: <harvested domain>-TextInfo.zip
From: <harvested address>
Subject chosen from the following:
Mail delivery failed
Mailzustellung wurde unterbrochen
smtp mail failed
SMTP Mail gescheitert
Message text:
This is an automatically generated Delivery Status Notification.
SMTP_Error []
I'm afraid I wasn't able to deliver your message.
This is a permanent error. I've given up. Sorry it didn't work out.
The full mail-text and header is attached!
Attachment name chosen from the following:
mail.zip
mail_body.zip
Email.zip
Email_body.zip
From: <harvested address>
Subject: Your Password
Message text:
Protected message is attached!
Attachment name chosen from the following:
reg_pass.zip
reg_pass-data.zip
From: <Random name>@cia.gov OR <Random name>@fbi.gov
Subject chosen from the following:
You visit illegal websites
Your IP was logged
Message text:
Dear Sir/Madam,
we have logged your IP-address on more than 30 illegal Websites.
Important:
Please answer our questions!
The list of questions are attached.
Yours faithfully,
Steven Allison
Message signature is either:
++++ Central Intelligence Agency -CIA-
++++ Office of Public Affairs
++++ Washington, D.C. 20505
++++ phone: (703) 482-0623
++++ 7:00 a.m. to 5:00 p.m., US Eastern time
OR:
*** Federal Bureau of Investigation -FBI-
*** 935 Pennsylvania Avenue, NW, Room 3220
*** Washington, DC 20535
*** phone: (202) 324-3000
Attachment name chosen from the following:
question_list.zip
list.zip
From: <Harvested address>
Subject: Paris_Hilton_&_Nicole_Richie
Message text:
The Simple Life:
View Paris Hilton & Nicole Richie video clips , pictures & more ;)
Download is free until Jan, 2006!
Please use our Download manager.
Attachment: downloadm.zip
From: <Random name>@RTLWorld.de OR <Random name>@RTL.de
Subject: RTL: Wer wird Millionaer
Message text:
Glueckwunsch: Bei unserer EMail Auslosung hatten Sie und weitere neun Kandidaten Glueck.
Sie sitzen demnaechst bei Guenther Jauch im Studio!
Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.
+++ RTL interactive GmbH
+++ Geschaeftsfuehrung: Dr. Constantin Lange
+++ Am Coloneum 1
+++ 50829 Koeln
+++ Fon: +49(0) 221-780 0 oder
+++ Fon: +49 (0) 180 5 44 66 99
Attachment name is chosen from the following:
Kandidat.zip
WWM.zip
Auslosung.zip
Casting.zip
Gewinn.zip
Info.zip
RTL-Admin.zip
RTl.zip
Webmaster.zip
RTL-TV.zip
OR any of the above filenames with "_Text" inserted before ".zip".
In each case the zip file contains a copy of the worm with the filename "File-packed_dataInfo.exe".
The worm searches for email addresses in files whose names contain the following strings:
pmr stm slk inbox imb csv bak imh xhtml imm imh cms nws vcf ctl dhtm cgi pp ppt
msg jsp oft vbs uin ldb abc pst cfg mdw mbx mdx mda adp nab fdb vap dsp ade sln
dsw mde frm bas adr cls ini ldif log mdb xml wsh tbb abx abd adb pl rtf mmf doc
ods nch xls nsf txt wab eml hlp mht nfo php asp shtml dbx
When first run, a message box may be displayed with the title "WinZip Self-Extractor" and containing the text "Error in packed Header".
At 00:00 on 6 January 2006, the worm attempts to download further code from the internet. If no code is downloaded the Sober worm is programmed to stop replicating via email.
Sophos's anti-virus products include Genotype™ detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against W32/Sober-Z (detected as W32/Sober-Gen) since version 3.99 W32/Sober-Z is a worm for the Windows platform.
W32/Sober-Z sends itself as an email attachment to addresses found in files on the hard disk.
Emails messages sent by the worm take one of the following forms. Subject lines may vary by having spaces replaced by underscore ('_') characters.
From: <Harvested address>
Subject: hi, ive a new mail address
Message text:
hey its me, my old address dont work at time. i dont know why?!
in the last days ive got some mails. i' think thaz your mails but im not sure!
plz read and check ...
cyaaaaaaa
Attachment: mailtext.zip
From: <random name>@Ebay.com
Subject: Sehr geehrter Ebay-Kunde
Message text:
Bei uns wurde ein neues Benutzerkonto mit dem Namen "<random username>" beantragt.
Um das Konto einzurichten, benoetigen wir eine Bestaetigung, dass die bei der Anmeldung angegebene e-Mail-Adresse stimmt.
Bitte senden Sie zur Bestaetigung den ausgefuellten Anhang an uns zurueck.
Wir richten Ihr Benutzerkonto gleich nach Einlangen der Bestaetigung ein und verstaendigen Sie dann per e-Mail, sobald Sie Ihr Konto benutzen koennen.
Vielen Dank,
Ihr Ebay-Team
Attachment: Ebay-User<random number>_RegC.zip
From: <random name>@BKA.de OR <random name>@bka.bund.de
Subject chosen from the following:
Ermittlungsverfahren wurde eingeleitet
Sie besitzen Raubkopien
Message text:
Sehr geehrte Dame, sehr geehrter Herr,
das Herunterladen von Filmen, Software und MP3s ist illegal und somit strafbar.
Wir moechten Ihnen hiermit vorab mitteilen, dass Ihr Rechner unter der IP <IP address> erfasst wurde. Der Inhalt Ihres Rechner wurde als Beweismittel sichergestellt und es wird ein Ermittlungsverfahren gegen Sie eingleitet.
Die Strafanzeige und die Moeglichkeit zur Stellungnahme wird Ihnen in den naechsten Tagen schriftlich zugestellt.
Aktenzeichen NR.:#<random number> (siehe Anhang)
Hochachtungsvoll
i.A. Juergen Stock
--- Bundeskriminalamt BKA
--- Referat LS 2
--- 65173 Wiesbaden
--- Tel.: +49 (0)611 - 55 - 12331 oder
--- Tel.: +49 (0)611 - 55 - 0
Attachment: Akte<random number>.zip
From: <harvested address>
Subject chosen from the following:
Account Information
Ihr Passwort
Message text:
Ihre Nutzungsdaten wurden erfolgreich geaendert. Details entnehmen Sie bitte dem Anhang.
*** http://www.<harvested domain>
*** E-Mail: PassAdmin@<harvested domain>
Attachment: <harvested domain>-TextInfo.zip
From: <harvested address>
Subject chosen from the following:
Mail delivery failed
Mailzustellung wurde unterbrochen
smtp mail failed
SMTP Mail gescheitert
Message text:
This is an automatically generated Delivery Status Notification.
SMTP_Error []
I'm afraid I wasn't able to deliver your message.
This is a permanent error. I've given up. Sorry it didn't work out.
The full mail-text and header is attached!
Attachment name chosen from the following:
mail.zip
mail_body.zip
Email.zip
Email_body.zip
From: <harvested address>
Subject: Your Password
Message text:
Protected message is attached!
Attachment name chosen from the following:
reg_pass.zip
reg_pass-data.zip
From: <Random name>@cia.gov OR <Random name>@fbi.gov
Subject chosen from the following:
You visit illegal websites
Your IP was logged
Message text:
Dear Sir/Madam,
we have logged your IP-address on more than 30 illegal Websites.
Important:
Please answer our questions!
The list of questions are attached.
Yours faithfully,
Steven Allison
Message signature is either:
++++ Central Intelligence Agency -CIA-
++++ Office of Public Affairs
++++ Washington, D.C. 20505
++++ phone: (703) 482-0623
++++ 7:00 a.m. to 5:00 p.m., US Eastern time
OR:
*** Federal Bureau of Investigation -FBI-
*** 935 Pennsylvania Avenue, NW, Room 3220
*** Washington, DC 20535
*** phone: (202) 324-3000
Attachment name chosen from the following:
question_list.zip
list.zip
From: <Harvested address>
Subject: Paris_Hilton_&_Nicole_Richie
Message text:
The Simple Life:
View Paris Hilton & Nicole Richie video clips , pictures & more ;)
Download is free until Jan, 2006!
Please use our Download manager.
Attachment: downloadm.zip
From: <Random name>@RTLWorld.de OR <Random name>@RTL.de
Subject: RTL: Wer wird Millionaer
Message text:
Glueckwunsch: Bei unserer EMail Auslosung hatten Sie und weitere neun Kandidaten Glueck.
Sie sitzen demnaechst bei Guenther Jauch im Studio!
Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.
+++ RTL interactive GmbH
+++ Geschaeftsfuehrung: Dr. Constantin Lange
+++ Am Coloneum 1
+++ 50829 Koeln
+++ Fon: +49(0) 221-780 0 oder
+++ Fon: +49 (0) 180 5 44 66 99
Attachment name is chosen from the following:
Kandidat.zip
WWM.zip
Auslosung.zip
Casting.zip
Gewinn.zip
Info.zip
RTL-Admin.zip
RTl.zip
Webmaster.zip
RTL-TV.zip
OR any of the above filenames with "_Text" inserted before ".zip".
From: <Harvested address>
Subject: Your Password
Message text:
Account and Password Information are attached!
***** Go to: http://www.<harvested domain>
***** Email: postman@<harvested domain>
Attachment name is chosen from the following:
reg_pass.zip
reg_pass-data.zip
In each case the zip file contains a copy of the worm with the filename "File-packed_dataInfo.exe".
The worm searches for email addresses in files whose names contain the following strings:
pmr stm slk inbox imb csv bak imh xhtml imm imh cms nws vcf ctl dhtm cgi pp ppt
msg jsp oft vbs uin ldb abc pst cfg mdw mbx mdx mda adp nab fdb vap dsp ade sln
dsw mde frm bas adr cls ini ldif log mdb xml wsh tbb abx abd adb pl rtf mmf doc
ods nch xls nsf txt wab eml hlp mht nfo php asp shtml dbx
When first run, a message box may be displayed with the title "WinZip Self-Extractor" and containing the text "Error in packed Header".
The worm creates the folder <Windows>\WinSecurity and creates the following files:
<Windows>\WinSecurity\csrss.exe
<Windows>\WinSecurity\services.exe
<Windows>\WinSecurity\smss.exe
<Windows>\WinSecurity\socket1.ifo
<Windows>\WinSecurity\socket2.ifo
<Windows>\WinSecurity\socket3.ifo
The files with EXE file extensions are copies of the worm. The files with IFO file extensions are MIME encoded copies of the worm for use when generating email attachments.
W32/Sober-Z creates the following registry entry in order to run itself on system startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows
<WINDOWS>\WinSecurity\services.exe
At 00:00 on 6 January 2006, the worm attempts to download further code from the internet. If no code is downloaded the Sober worm is programmed to stop replicating via email.
Sophos's anti-virus products include Genotype™ detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against W32/Sober-Z (detected as W32/Sober-Gen) since version 3.99
|
