As of May 2, 2005, 11:50 AM (Pacific Daylight Time/GMT -7:00), TrendLabs has declared a Medium Risk Virus Alert to control the spread of WORM_SOBER.S.
TrendLabs has received numerous infection reports indicating that this malware is spreading in Germany and the U.S.A.
This worm spreads by mass-mailing copies of itself using its own SMTP (Simple Mail Transfer Protocol) engine. It gathers its target recipients from files with certain extensions names. Notably, it avoids sending messages to addresses that contain specific strings.
Using social engineering techniques, it sends out an email supposedly sent by the soccer organization FIFA, informing recipients that they have won tickets for the upcoming FIFA World Cup 2006 in Germany.
The email it sends out has the following details:
From: (any of the following)
. Admin
. hostmaster
. info
. postmaster
. register
. service
. webmaster
Subject: (any of the following German subjects) . Glueckwunsch: Ihr WM Ticket . Ich bin's, was zum lachen
. Ihr Passwort . Ihre E-Mail wurde verweigert . Mail-Fehler!* . WM Ticket Verlosung*WM-Ticket-Auslosung
(or any of the following English subjects) . Re:
. Your Password
. Registration Confirmation
. Your email was blocked
. mailing error
Message body: (any of the following)
. Passwort und Benutzer-Informationen befinden sich in der beigefuegten Anlage.
*-*
http://www.
*-* MailTo: PasswordHelp
. Diese E-Mail wurde automatisch erzeugt Mehr Information finden Sie unter
http://www.
. Folgende Fehler sind aufgetreten:
. Fehler konnte nicht Explicit ermittelt werden
. End Transmission
. Aus Datenschutzrechtlichen Gruenden, muss die vollstaendige E-Mail incl. Daten gezippt & angehaengt werden. Wir bitten Sie, dieses zu beruecksichtigen.
. Auto ReMailer# [
. Nun sieh dir das mal an!
Was ein Ferkel ....
. Herzlichen Glueckwunsch,
--- FIFA-Pressekontakt:
ok ok ok,,,,, here is it
r die 64 Spiele der Weltmeisterschaft 2006 in Deutschland sind Sie dabei.
Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.
ok2006
Team
St. Rainer Gellhaus
error-
--- Pressesprecher Jens Grittner und Gerd Graus
--- FIFA Fussball-Weltmeisterschaft 2006
--- Organisationskomitee Deutschland
--- Tel. 069 / 2006 - 2600
---
Jens.Grittner@ok2006.de
---
Gerd.Graus@ok2006.de
. Account and Password Information are attached!
Visit:
http://www.
. AntiVirus Service
**** WebSite: .
Attachment: (any of the following)
. mail_info.zip
. okTicket-info.zip
. LOL.zip
. _PassWort-Info.zip
. autoemail-text.zip
TrendLabs will be releasing the following EPS deliverables:
TMCM Outbreak Prevention Policy 171
Official Pattern Release 2.611.00
Damage Cleanup Template 588
For more information on WORM_SOBER.S, you can visit our Web site at:
http://www.trendmicro.com/vinfo/viru...e=WORM_SOBER.S
You can modify subscription settings for Trend Micro newsletters at:
http://www.trendmicro.com/subscriptions/default.asp