There have been reports that the new year will start with a bang possibly on the 5th of January or 6th of January, when a new SOBER variant is suspected to be released by the same group that caused the recent WORM_SOBER.AG outbreak in November.
The reports may have been based on the analysis that WORM_SOBER.AG will download an executable file Sober.exe) possibly on either January 5, 2006 or January 6, 2006 from certain URLs that are hard-coded and encrypted within the SOBER.AG worm. These "predefined" URLs are not the exact sites that may used - an algorithm based on the date is used to generate the exact URLs that will be used on the target date itself.
For more information on WORM_SOBER.AG, please visit
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SOBER.AG
source: Trend Micro Weekly Virus Report - December 9, 2005
====
tags: WORM_SOBER.AG email forwards
