Aliases

Email-Worm.Win32.Sober.a (Kaspersky Lab) is also known as: I-Worm.Sober.a (Kaspersky Lab), W32/Sober.a@MM (McAfee),   W32.Sober@mm (Symantec),   Win32.HLLM.Odin (Doctor Web),   W32/Sober-A (Sophos),   Win32/Sober.A@mm (RAV),   WORM_SOBER.A (Trend Micro),   Worm/Sober (H+BEDV),   W32/Sober.A@mm (FRISK),   Win32:Sober (ALWIL),   I-Worm/Sober.A (Grisoft),   Win32.Sober.A@mm (SOFTWIN),   Worm.Sober (ClamAV),   W32/Sober.A.worm (Panda),   Win32/Sober.A (Eset)

Description added	Oct 27 2003
Behavior	Email Worm

Technical details

Sober is a network worm that spreads via email in message file attachments. It is written in Visual Basic and is 63KB in size. The file is compressed by UPX.

Infected email messages have arbitrary subjects and body texts in English and German. The name of the file attachment can vary with different file extensions - .bat, .com, .exe, .pif, .scr

Exmaples:

Subject: New Sobig-Worm variation (please read)

Body text: New Sobig variation in the net.
               You must change any settings before the worm control your computer!
But, read the official statement from Norton Anti Virus!

File attachment: NAV.pif

Installing
The Sober worm only become active if a user opens the file attachment. Upon being launched the Sober network worm displays on the screen a false error message:

It then creates three copies of itself in the system's Windows directory using the following names:

similare.exe
systemchk.exe
winrea.exe

Next, Sober registers itself in the system registry's auto-run key:

 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   syspath=%System%\drv.exe

Spreading
Sober searches for files that have one of the following file extensions:

 htt
 rtf
 doc
 xls
 ini
 mdb
 txt
 htm
 html
 wab
 pst
 fdb
 cfg
 ldb
 eml
 abc
 ldif
 nab
 adp
 mdw
 mda
 mde
 ade
 sln
 dsw
 dsp
 vap
 php
 asp
 shtml
 shtm

In these files, Sober searches for victim email addresses with which to send itself to. Sober uses a direct connection to the SMTP server.

Infected message subjects are chosen at random from the following list:

 "You send spam mails (Worm?)"
 "A worm is on your computer!"
 "Now, it's enough"
 "You have sent me a virus!"
 "Hi darling, what are you doing now?"
 "Be careful! New mail worm"
 "Re: Contact"
 "RE: Sex"
 "Sorry, I've become your mail"
 "Hey man, long not see you"
 "Re: lol"
 "Viurs blocked every PC (Take care!)"
 "Surprise"
 "I've become your mail!"
 "Advise who I am!"
 "New Sobig-Worm variation (please read)"
 "Back At The Funny Farm"
 "I love you (I'm not a virus!)"
 "Neuer Virus im Umlauf!"
 "Sie versenden Spam Mails (Virus?)"
 "Ein Wurm ist auf Ihrem Computer!"
 "Langsam reicht es mir"
 "Sie haben mir einen Wurm geschickt!"
 "Hi Schnuckel was machst du so ?"
 "VORSICHT!!! Neuer Mail Wurm"
 "Re: Kontakt"
 "RE: Sex"
 "Sorry, Ich habe Ihre Mail bekommen"
 "Hi Olle, lange niks mehr geh"
 "Re: lol"
 "Viurs blockiert jeden PC (Vorsicht!)"
 "_berraschung"
 "Ich habe Ihre E-Mail bekommen !"
 "Jetzt rate mal, wer ich bin !?"
 "Neue Sobig Variante (Lesen!!)"
 "Back At The Funny Farm"
 "Ich Liebe Dich"

The file attachment is chosen from the following list (the following list is not comprehensive):

 AntiVirusDoc.pif 
 Check-Patch.bat 
 Screen_Doku.scr 
 Removal-Tool.exe 
 Perversionen.scr 
 Bild.scr 
 robot_mail.scr 
 RobotMailer.com 
 Privat.exe 
 AntiTrojan.exe 
 Mausi.scr 
 NackiDei.com 
 Anti-Sob.bat 
 screen_doc.scr 
 potency.pif 
 perversion.scr 
 pic.scr 
 CM-Recover.com 
 playme.exe 
 robot_mailer.pif 
 little-scr.scr 
 security.pif 
 Funny.scr 
 Liebe.com 
 Odin_Worm.exe 
 anti_virusdoc.pif 
 check-patch.bat 
 removal-tool.exe 
 love.com 
 nacked.com 
 Hengst.pif 
 schnitzel.exe 
 anti-trojan.exe 
 NAV.pif

Infected message normally have the following signature:

 Automatic Mail notification: Robot-System__#"

Other details
The Sober worm contains the following text strings:

Programmer of the -Sobig Worm-
 Congratulations!! Your Sobig Worms are very good!!!
 You are a very good programmer!
 Yours faithfully
 Odin alias Anon
 Odin_Worm.exe