As with previous variants of Sober, the worm composes messages in English and German. At this stage, reports of infection are low. When the file (PW_Klass.Pic.packed-bitmap.exe) in the zip attachment is executed it displays a fake error message: "Error in packed file! CRC header must be $7ff8". The replication is buggy and may send corrupt attachments.
Aliases:
W32/Sober.R [Sophos]; Sober.S[F-Secure]; W32/Sober.R@mm [Norman]; W32.Sober.Q@mm [Symantec]; W32/Sober.Y [Panda] and WORM_SOBER.AC[Trend].