[Mimedefang] slightly OT - Next Sober attack

Jan Pieter Cornet johnpc at xs4all.nl
Thu Dec 8 14:52:25 EST 2005

On Thu, Dec 08, 2005 at 12:27:21PM -0500, WBrown at e1b.org wrote:
> A collegue sent me this:
> "The next planned widespread of 2005?s most prolific e-mail worm, Sober, 
> is scheduled to start on January 5, 2006 based on commands hard-coded 
> within the worm."
> http://www.it-observer.com/articles.php?id=972

Which is the same date that Sober.I stopped reproducing.

See http://www.sophos.com/virusinfo/analyses/w32soberi.html
(it's also quite obvious from our online virus graphs, which go back
about a year... logging started shortly before the outbreak of 
Sober.I in november 2004).

I seem to recall there was mention of the virus trying to download
something around that time, and executing that, but all download sites
were taken offline before the download began... or was that another
sober variant?

Also sober variants have been known to cause "rightwing german hate spam"...
(sober.q), maybe we're getting a rerun of that on januari 5th?

#!perl -wpl # mmfppfmpmmpp mmpffm <pmmppfmfpppppfmmmf at fpffmm4mmmpmfpmf.ppppmf>
$_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9,
3,1)]),5,1)='`'lt$&;$f.eig;                                # Jan-Pieter Cornet

More information about the MIMEDefang mailing list