Sober starts its update tomorrow, and yes, we will be monitoring the download URL’s. And here’s some statistics to show WORM_SOBER.AG’s.. persistence.
(This data is from the Email Honeypot samples)
Yep, that’s more than a million samples from Sober, in about a month of monitoring, and that’s just on our side of the monitoring pool. This may mean there are still LOTS of infected systems out there, and/or Sober is a quick mass-mailing-sob. heheheh