Koobface Worm Variant Hits Facebook

The New Acunetix V12 Engine


Koobface is computer worm that targets the users of the social networking websites Facebook and Myspace. Koobface ultimately attempts, upon successful infection, to gather sensitive information from the victims such as credit card numbers.

A new variation of Koobface has popped up aggressively on Facebook and is attempting to steal login credentials for other social networking sites.

It’s heavy on the user of Social Engineering by using the old familiarity ploy and trying to lure users into execution the spurious malware.

Researchers at Trend Micro report that a new variant of the Koobface worm is squiggling through Facebook, infecting users and attempting to steal cookies with log-in information for sites such as MySpace.com, MyYearbook.com, Bebo and Hi5 Networks. The Koobface worm first appeared in 2008.

Researchers at Trend Micro are reporting that a new variant of the Koobface worm is spreading on Facebook.

Koobface first appeared in 2008, with separate variants striking members of Facebook and MySpace.com. Now the Koobface worm is back again, with an eye toward stealing cookies for other social networking sites.

According to Trend Micro, the new variant sends Facebook messages claiming to be from a friend. The messages link to a spoofed YouTube video. In an interesting social engineering ploy, the malicious landing page not only displays the friend’s name, but also a picture pulled from the person’s Facebook profile.

It’s a pretty standard modus operandi for malware distributors, a new version of Flash seems to be a very common theme amongst these kinds of worm.

It seems like quite a lot of thought has gone into the design of this worm and due to the pretty slick distribution method it might become quite a large scale infection. It’s endgame is to create some kind of botnet and to steal the real information of value (banking details, credit card numbers etc).


The page prompts the user to install a new version of Adobe Flash. Users who agree are redirected to a download site for the file setup.exe, which is the new Koobface variant. Trend Micro detects the worm as WORM_KOOBFACE.AZ, and reported March 1 that its researchers had seen more than 300 unique IP addresses hosting the .exe file.

Trend Micro is expecting to see more.

“We’re only flagging a few hits at the moment, but the complexity with which this threat has been created shows how much work has been done to social-engineer social networks with the end game of creating [botlike] accounts to send out third-party links to almost anything,” said Jamz Yaneza, a threat researcher at Trend Micro.

The latest iteration of the worm runs on Windows 98, ME, NT, 2000 and XP and Server 2003. It sends and receives information by connecting to several servers, allowing hackers to remotely execute commands on a compromised machine.

Once infected the malware will search the users machine for Cookies from other social networking sites such as MySpace.com, Hi5 Networks, MyYearbook.com and Bebo.

As always, warn whoever you know that might use Facebook and generally tell people not to install or run anything that they aren’t expecting or didn’t specifically look for.

If they want to update Flash tell them ONLY to ever do it at the Adobe site.

Source: eWeek

Posted in: Exploits/Vulnerabilities, Malware, Web Hacking

, , , , ,


Latest Posts:


BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.
Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.


5 Responses to Koobface Worm Variant Hits Facebook

  1. Mafiya March 3, 2009 at 11:24 am #

    Any knowledge on how to get rid of it yet? Not that i have it, just that i work on computers, and we remove viruses. Would i do the Malwarebtyes, SuperAntiSpyware, HiJackThis, CCleaner? Or would that not get rid of it?

  2. Bogwitch March 3, 2009 at 6:42 pm #

    @Mafiya.

    No experience of it myself, but as with any other trojan, the safest way would be a complete rebuild of the workstation, unless you keep computational hashes of all the executables on your customers drives for comparison to ensure they have not become infected. Or are you peddling fixes that cannot be verified?

  3. Mafiya March 3, 2009 at 8:45 pm #

    Most customers are below 18, as i’m at a school. And we do it for free, just to gain experience. And what do you mean a complete rebuild? Just a clean install?

  4. Anonymous March 4, 2009 at 5:38 am #

    Mafiya: Bogwitch does mean a complete reinstall of the operating system(s). As it technically isn’t spyware/adware, your mileage may vary using only the tools you’ve specified. Solid antivirus software _should_ be enough, but it’s far better to never get infected in the first place.

  5. masterstyles March 25, 2009 at 11:08 pm #

    search for combofix , we use it a 1000 times a day, better than ur method, use it then mbam then ccleaner :)