W32/Sober.U Worm

 Information about the W32/Sober.U Worm:

W32/Sober.U is an email worm. This worm is a variant of W32/Sober. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be either in English or German language.

The subject of the mail in English will be as follows;

Your email

The subject of the mail in German will be as follows;

Ihre eMail!

The body of the infected mail will be either in English or German language.

The body of the mail in English will be as follows;

Hello,
Sorry, sorry sorry, because,, my English is not the best!

ok, I've got an email with an Excel-Table. But I am not the recipient, the
recipient are you!
I think, it's an mail error!
OK, here is your table back!

cya....

The body of the mail in German will be as follows;

Guten Tag,
jemand schickte mir eine Mail mit einer Excel oder Access Tabelle (kenne
mich da nicht so aus!).
Jedenfalls ist diese Mail aber an ihre Mail Adresse adressiert, aber zu
meiner gekommen??? Ist wohl irgendein Fehler.

Ok, hier haben Sie sie wieder zurueck!

gruss

The infected attachment will be excel_table.zip.

Upon execution of the infected attachment, the worm displays a message box with the following message.

Error in Excel Key

It drops a copy of worm as services.exe in the Windows folder.

It also drops the following files in the Windows System folder.

nonrunso.ber
bbvmwxxf.hml
rubezahl.rub
gdfjgthv.cvq
runstop.rst
langeinf.lin

It modifies the Windows registry at the following locations to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files with the following extensions and collects all the available email addresses from the infected system.

slk, inbox, imb, csv, bak, imh, xhtml, imm, imh, cms, nws, vcf, ctl, dhtm, cgi, pp, ppt, msg, jsp, oft, vbs, uin, ldb, abc, php, phtm, stm, pmr, pst, cfg, mdw, mbx, mdx, mda, adp, nab, fdb, vap, dsp, ade, sln, dsw, mde, frm, bas, adr, cls, ini, ldif, log, mdb, xml, wsh, tbb, abx, abd, adb, pl, rtf, mmf, doc, ods, nch, xls, nsf, txt, wab, eml, asp, shtml and dbx.

It saves all collected email addresses in concon.www file, which is created by this worm in the Windows folder.

The worm mails itself to these addresses using its own SMTP engine.

This worm first appeared on November 15, 2005.

 Other names of W32/Sober.U Worm:

This Worm is also known as W32/Sober.v@MM.