Sober steals your passwords

For the last 24 hours or so we’ve seen a number of new Email-Worm.Win32.Sober variants, some of which we have got an alert out for.

We went from Sober.u to Sober.z about four hours ago.

These Sobers are pretty much the same like before, for instance they still use exclusive lock and the possibility to download files.

What’s interesting is that these Sobers also drop not-a-virus:PSWTool.PassView.162 onto the system.

As the name suggests this program is a tool which is able to show certain passwords.

In this case the program can show the passwords stored by Internet Explorer and Outlook.

As nor Sober nor PSWTool.PassView.162 can send out the obtained info from PassView, it is likely that the file(s) that Sober is (possibly) going to download will have this ability.

Naturally we’re closely monitoring the situation and we will keep you updated in case something interesting comes along.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.