Email-Worm:W32/Sober.G
Summary
Sober.G appeared in the beginning of May 2004. This worm variant is similar to previous variants.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Update on May 27th, 2004
Certain versions of F-Secure Anti-Virus can not detect Sober.G worm in ZIP archives. F-Secure is providing hotfixes for its anti-virus products to solve that problem:
FSAV 5.42/5.41 Hotfix 3: https://support.f-secure.com/enu/corporate/downloads/hotfixes/av5-hotfixes.shtml
FSAV Client Security Hotfix 10 (Anti-Virus Hotfix 5): https://support.f-secure.com/enu/corporate/downloads/hotfixes/av-cs-hotfixes.s...
FSAV for Samba Servers 4.60 Hotfix 2: https://support.f-secure.com/enu/corporate/downloads/hotfixes/av-linux-hotfixe...
FSAV Linux 4.52 Hotfix 5: https://support.f-secure.com/enu/corporate/downloads/hotfixes/av-linux-hotfixe...
Update on May 16th, 2004
F-Secure is increasing the level of Sober.G to Radar 2 as we are seeing increased numbers of it during the weekend. It sends emails in both German and English with varying content and attachments.
Update on May 15th, 2004
We got a few reports about Sober.G spreading in the wild on May 15th, 2004. After comparing samples from the worm's messages and the sample that we had originally received and described, we found out that our conclusions about Sober.G being intended were incorrect. It happened because the sample that we originally got was taken from an infected computer's Windows System folder and not from an email message. Sober worm has a "feature" of modifying its executable file that it drops to a hard drive. It changes a byte at offset 0xA0 to 0x60 when its file is installed to a system. However, the file that the worm sends out in email messages has this byte value zeroed. So the sample we originally received did not install itself properly and it did not create MIME-encoded files for spreading because the worm "thought" it was already installed. Failure of the worm to install itself properly and create files necessary for its spreading drove us to the conclusion that the worm was intended. We are sorry for confusion.
The worm is written in Visual Basic. The worm's file is a PE executable of length 49661 bytes, packed with a modified version of UPX file compressor. The worm has its own SMTP engine.
Installation to system
When the worm's file is started it shows the following messagebox:
If a user clicks 'Yes' button, the worm creares the converted_<filename>.txt file where <filename> is the name of the worm's file. The worm writes random garbage to that file and opens it with Notepad:
Then the worm installs itself to system. It copies itself to Windows System folder with a semi-randomly generated name and EXE extension. The following text strings are used to generate the file name of the worm's executable:
sys host dir expolrer win run log 32 disc crypt data diag spool service smss32
After that the worm creates startup keys for its file in Windows Registry. The key names are also semi-randomly generated from the above given list. The following keys are created:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\ .exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] " " = "%WinSysDir%\ .exe"
During its installation cycle the worm creates the following files in Windows System folder:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
These files have zero length and they are used to disable previous variants of Sober if they are installed on an infected computer.
Additionally the worm creates the following files:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
These files are MIME-encoded copies of the worm's executable file and a ZIP archive with the worm's file. These files will be used for spreading of the worm in email messages.
Spreading in emails
The worm sends email messages with English and German texts and its file attached. The attached file can be an executable or a ZIP archive containing the worm's executable. The worm composes several different types of messages and the content of these messages is variable. Here's an example of a German message sent by the worm:
Before spreading the worm scans files with certain extensions on all hard disks to harvest email addresses. Files with the following extensions are scanned:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
The found email addresses and user names are saved in these 3 files that the worm created in Windows System folder:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
When the worm is active in memory it blocks access to these files as well as to its MIME-encoded files and its executable file.
The worm ignores email addresses that contain any of the following substrings:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
If the worm sends infected messages to domains with siffixes '.de', '.ch', '.at', '.li' or to 'gmx.' domain, it composes messages in German, otherwise English messages are composed.
The worm can compose English messages from the following text string arrays:
Subject (one of the following):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
Message body (one of the following):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
Attachment name (one of the following):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
The worm can compose German messages from the following text string arrays:
Subject (one of the following):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
Message body (one of the following):
Man hort und sieht nikkes mehr von Dir! Haste D.e.i.n.e. Tage oder so?;) Ware mal sehr nett von dir, wenn Du mal was von dir horen laaaasssssen tutest(tut tut)! bis spaeeeter mal Diese Information ist Passwort geschutzt. Da Sie uns Ihre Personlichen Daten mitgeteilt haben, ist das Passwort Ihr Geburts-Datum! Viel Spass mit unserem Angebot Guten Tag! Das diese email automatisch generiert wurde, darf aus Datenschutzrechtlichen Grunden die vollstandige email nur angehangt werden. Ihre neuen Account Daten finden Sie im beigefugten Dokument. Vielen Dank fur Ihr Verstandnis. Wir bitten dies zu berucksichtigen. Guten Tag, Da Sie vor einiger Zeit ihren-Tarif bei uns gewechselt haben, mussen wir darauf hinweisen, dass Ihre Zahlung noch nicht bei uns eingegangen ist. Leider mussen wir darauf hinweisen, das rechtliche Schritte gegen Sie eingeleitet werden konnen. Alle Informationen bezuglich diesem Tarifes finden Sie im mitgesendetem Dokument. Hochachtungsvoll R. Peters ### Peters Multi- Media GmbH ### www. Hi... ich wollte dir schnell mal mitteilen, dass sich ein gefahrlicher Virus/Trojaner uber Internet Seiten verbreitet. Achte auf die Infos im Anhang!!! Ciao! Hey alles klar? Hier sind die Tools die du haben wolltest! Viel Spa? damit ;) Cu! Weitere Informationen befinden sich im Anhang dieser Mail Da Du mir dein Foto geschickt hast, hier nun ein Bild von mir! Ja, leider kann ich es nicht andern aber es ist so. Wenn Du genauso fuhlst, dann schau dir bitte den Anhang an. Wenn nicht, dann losche ungeoffnet diese Mail! Es ware mir sonst zu peinlich .....
Attachment name (one of the following):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
Sober's attachment name can contain a random number and can have one of the following extensions:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
Also the attachment can be sent in a ZIP archive. In this case the worm's file inside the archive will have double extension. The first extension is selected from the following list:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
The attachment name can be as well "borrowed" from any file name on an infected system.
The worm can also compose fake bounced messages.
The subject of an infected email can have 'FwD:' string.
The worm fakes the sender's email address. It can compose fake sender's email address from the following parts:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
Sober.G can place a fake anti-virus scanner report in the message body trying to persuade a recipient that the message was scanned by an on-line scanner and no infection was found.
Payload
Sober.G can download and activate an executable file from one of the following websites:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe" [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "" = "%WinSysDir%\.exe"
The name of the downloaded executable file is 'doerkggg.exe'.
Deactivation of the worm
The worm periodically looks for a file named 'odin-anon.ger' and it this file is found, the worm uninstalls itself from memory. Moreover, if this file is present in Windows System folder, the worm does not install itself to a system.
A message from Sober's author
Sober.G worm creates a file named NoSpam.readme in Windows System folder and writes a German text there. That text is a message from the author of the worm to AV companies. In the message the author denies being a spammer or a hacker and reports his age group.