Sober.p reaches new heights – and then dies?

Sober.p currently is not spreading. After days of sending out emails, it’s now checking for updates at predefined locations, which indicates that more malware is likely to follow.

But one week after Email-Worm.Win32.Sober.p’s initial sighting it seemed more prevalent than ever. Why is this?

Firstly, the worm’s continued spread shows that there still aren’t enough companies running antivirus solutions on their mail servers as they could have stopped the spreading days ago.

Secondly, from a social engineering point of view it’s pretty good. The bilingual messages – English and German – always seem to have a certain amount of success – almost all Sober variants have hit Germany and the countries surrounding it very hard.

This time Sober also takes advantage of the World Cup football which will be held in Germany in 2006. However, my personal email addresses were bombarded with Sober.p emails, yet I didn’t receive a single sample regarding the World Cup.

Other email worms which have used similar social engineering tactics haven’t been this successful by a long shot. I think Sober.p’s real success is due to something else, namely its protection mechanism.

As with previous Sober variants, Sober.p makes use of a certain mechanism to lock out any I/O access to its files.
In other words: Other programs can’t access Sober’s files. Not even applications running under SYSTEM account can access them while Sober is resident in memory.
This mechanism has been improved over time – earlier variants of Sober couldn’t stop SYSTEM from accessing its files.

And what’s the result? Very simple; if something can’t be scanned, then malicious code can’t be detected. This rules out the chance of Sober being detected while running an on-demand scan. So what now? This is where the quality of an anti-virus’s memory scanner comes in.

First the solution needs to detect Sober running in memory, then it has to kill the processes.
This is where some antivirus programs are failing; either they don’t have a memory scanner, or the scanner has limited functionality which isn’t able to kill the processes.

If you aren’t aware of infection, how can you take measures against it? With Sober’s protection mechanism making it able to outsmart some antivirus scanners, it’s likely we haven’t seen the last of this family yet.