New Sober...Tomorrow
Monday November 14, 2005
German police are warning of a new variant of the Sober worm - claiming it will be released tomorrow. According to the Bayerische Landeskriminalamt (BLKA), the infected attachment will be named either 'Word Text.zip' or 'registration.zip'. As with previous Sober worm variants, the email will be in either German or English, depending on the recipient's domain. The alleged messages are said to be one of the following:
English:
Subject: Registration Confirmation
Message body: Thanks for your registration. Your data are saved in the zipped Word.doc file!
Attachment: registration.zip
German:
Subject: Haben Sie diese Email verschickt?
Message body: Es waere von Vorteil, wenn Sie sich dazu aeussern wuerden!! Um es vorweg zu sagen: Ich bin kurz davor eine Anzeige zu erstatten. Sie Spinnen wohl! Die E-mail hat meine Tochter gelesen!!! Ich habe Ihnen diese Word-Text Datei zu meiner Entlastung zurückgeschickt.
Attachment Word-Text.zip
The prediction is based on evidence uncovered by the Munich public prosecutor and Bavarian police, in a year long investigation into the Sober worm.
What's even more odd - antivirus vendor Trend Micro has already released a description of this as-yet-unleashed new Sober worm, dubbing it WORM_SOBER.AD and pre-listing it - site unseen - as an in-the-wild threat.
English:
Subject: Registration Confirmation
Message body: Thanks for your registration. Your data are saved in the zipped Word.doc file!
Attachment: registration.zip
German:
Subject: Haben Sie diese Email verschickt?
Message body: Es waere von Vorteil, wenn Sie sich dazu aeussern wuerden!! Um es vorweg zu sagen: Ich bin kurz davor eine Anzeige zu erstatten. Sie Spinnen wohl! Die E-mail hat meine Tochter gelesen!!! Ich habe Ihnen diese Word-Text Datei zu meiner Entlastung zurückgeschickt.
Attachment Word-Text.zip
The prediction is based on evidence uncovered by the Munich public prosecutor and Bavarian police, in a year long investigation into the Sober worm.
What's even more odd - antivirus vendor Trend Micro has already released a description of this as-yet-unleashed new Sober worm, dubbing it WORM_SOBER.AD and pre-listing it - site unseen - as an in-the-wild threat.


No comments yet. Leave a Comment