Key Dates in Past and Present Sober Variants

• URL: http://www.secureworks.com/research/threats/soberdates
• Date: December 9, 2005
• Author: Joe Stewart

Introduction

Recently, some speculation has surfaced that the update time/date for the current Sober variant is tied to Nazi Party history. While this may or may not be the case, it is important to note that several past variants of Sober all updated themselves in the same way, using completely different dates. We went back and extracted the key dates from all previous Sober variants. The ones with similar date comparisons were the N, P, Q and T, V, W, X and Y variants (according to Kaspersky Anti-Virus definitions).

Algorithm

The date comparison algorithm takes a hard-coded base date, which it does a Visual Basic DateDiff function of the current time (from a hard-coded list of remote timeservers). The resulting value is compared against preset variables which control the execution of various functions, including when to start spreading, and when to download the next update.

Note that the "begin update" logic in the current variant is actually "current date > Jan 5", not "current date == Jan 5", so the update other sources are saying will occur on Jan 5, 2006 won't actually happen until Jan 6, 2006.

Key Dates

Below are the results of our analysis of the key dates within each variant that uses the same DateDiff comparison logic. Correlation with the Nazi party history timeline is left as an exercise for the reader.

Sober.N - compiled Mon Apr 18 23:43:39 2005
Base date: 2005-04-13
DiffDate comparisons: 6,9,-777
Resulting key dates:

• Wednesday, February 26, 2003
• Wednesday, April 13, 2005
• Tuesday, April 19, 2005
• Friday, April 22, 2005

Sober.P - compiled Fri Apr 29 09:31:22 2005
Base date: 2005-04-27
DiffDate comparisons: 5,12,-777
Resulting key dates:

• Wednesday, March 12, 2003
• Monday, May 2, 2005
• Monday, May 9, 2005

Sober.Q - compiled Wed May 11 07:46:10 2005
Base date: 2005-05-11
DiffDate comparisons: 4,11,-777
Resulting key dates:

• Wednesday, March 26, 2003
• Sunday, May 15, 2005
• Sunday, May 22, 2005

Sober.T - compiled Mon Nov 14 16:46:14 2005
Base date: 2005-10-29
DiffDate comparisons: 17,18,19,-777
Resulting key dates:

• Saturday, September 13, 2003
• Tuesday, November 15, 2005
• Wednesday, November 16, 2005
• Thursday, November 17, 2005

Sober.V - compiled Tue Nov 15 04:05:26 2005
Base date: 2005-10-29
DiffDate comparisons: 17,18,19,-777
Resulting key dates:

• Saturday, September 13, 2003
• Tuesday, November 15, 2005
• Wednesday, November 16, 2005
• Thursday, November 17, 2005

Sober.W - compiled Tue Nov 15 04:10:52 2005
Base date: 2005-10-29
DiffDate comparisons: 17,18,19,-777
Resulting key dates:

• Saturday, September 13, 2003
• Tuesday, November 15, 2005
• Wednesday, November 16, 2005
• Thursday, November 17, 2005

Sober.X - compiled Tue Nov 15 06:16:34 2005
Base date: 2005-10-29
DiffDate comparisons: 17,18,19,-777
Resulting key dates:

• Saturday, September 13, 2003
• Tuesday, November 15, 2005
• Wednesday, November 16, 2005
• Thursday, November 17, 2005

Sober.Y - compiled Mon Oct 24 16:49:41 2005
Base date: 2005-10-29
DiffDate comparisons: 23,68,69,-777
Resulting key dates:

• Saturday, September 13, 2003
• Monday, November 21, 2005
• Thursday, January 5, 2006
• Friday, January 6, 2006

The -777 offset remains constant in every variant, and is probably simply used to indicate that communication with the timeservers failed. Otherwise, we can see there are numerous dates which may or may not have significance. For instance, the base date of the past few variants has been October 29. This is the birthday of Joseph Goebbels, Nazi Minister of Propaganda.

Conclusion

Many more correlations could be made, simply because the Nazi party timeline has so many significant events over the two decades it rose to power in Germany. The only thing that is factually known to connect the Sober author to Nazi ideals is its use in the past to send massive quantities of German-language nationalist propaganda. Until the Sober author announces his true intent, or is caught, we will only be able to speculate on the rest.