FortiGuard Advisory (FGA-2005-14)

On Monday November 14, 2005 Fortinet received the first samples of Sober, a Mass-mailer that sends itself to addresses harvested from the infected system. On Monday November 21, 2005 further variants were discovered. Messages are sent in German and English, which is similar to the techniques deployed by previous variants of the worm. As with other variants of the Sober worm, it originated in Germany. While the variants spotted last week are still spotted in the wild in low numbers, the latest variant (W32/Sober.AD-mm) is currently being detected in large numbers and Fortinet rates it a level 4 threat. This latest threat uses fake FBI warnings to entice the users to execute the email attachments, resulting in system infection.

Variants we have received in the last few days:

Some of the subjects used by the virus:

	Ermittlungsverfahren_wurde_eingeleitet
	SMTP Mail gescheitert
	Haben Sie diese EMail verschickt?
	Thanks for your registration
	Hi, Ich bin's
	I've got your email on my account
	Ich habe Ihre E-Mail erhalten
	Your email
	Ihre eMail!

Some of the file attachments used by the virus:

	Email_Text.zip
	Word-Text.zip
	registration.zip
	reg_text.zip
	foto.zip
	email_photo.zip
	excel_table.zip
	Tabelle.zip

All variants deployed the common technique of circumventing email addresses related to some antivirus vendors — thus avoiding raising its profile amongst the community that may be able to stop its spread, increasing the window of opportunity for propagation.

Disclaimer:

Although Fortinet has attempted to provide accurate information in these materials, Fortinet assumes no legal responsibility for the accuracy or completeness of the information. More specific information is available on request from Fortinet. Please note that Fortinet's product information does not constitute or contain any guarantee, warranty or legally binding representation, unless expressly identified as such in a duly signed writing.

About Fortinet ( www.fortinet.com ):

Fortinet is the pioneer and leading provider of ASIC-accelerated unified threat management, or UTM, security systems, which are used by enterprises and service providers to increase their security while reducing total operating costs. Fortinet solutions were built from the ground up to integrate multiple levels of security protection--including firewall, antivirus, intrusion prevention, VPN, spyware prevention and anti-spam -- designed to help customers protect against network and content level threats. Leveraging a custom ASIC and unified interface, Fortinet solutions offer advanced security functionality that scales from remote office to chassis-based solutions with integrated management and reporting. Fortinet solutions have won multiple awards around the world and are the only security products that are certified in six programs by ICSA Labs: (Firewall, Antivirus, IPSec, SSL, Network IPS, and Anti-Spyware). Fortinet is privately held and based in Sunnyvale, California.