Koobface Worm Variant Hits Facebook


Koobface is computer worm that targets the users of the social networking websites Facebook and Myspace. Koobface ultimately attempts, upon successful infection, to gather sensitive information from the victims such as credit card numbers.

A new variation of Koobface has popped up aggressively on Facebook and is attempting to steal login credentials for other social networking sites.

It’s heavy on the user of Social Engineering by using the old familiarity ploy and trying to lure users into execution the spurious malware.

Researchers at Trend Micro report that a new variant of the Koobface worm is squiggling through Facebook, infecting users and attempting to steal cookies with log-in information for sites such as MySpace.com, MyYearbook.com, Bebo and Hi5 Networks. The Koobface worm first appeared in 2008.

Researchers at Trend Micro are reporting that a new variant of the Koobface worm is spreading on Facebook.

Koobface first appeared in 2008, with separate variants striking members of Facebook and MySpace.com. Now the Koobface worm is back again, with an eye toward stealing cookies for other social networking sites.

According to Trend Micro, the new variant sends Facebook messages claiming to be from a friend. The messages link to a spoofed YouTube video. In an interesting social engineering ploy, the malicious landing page not only displays the friend’s name, but also a picture pulled from the person’s Facebook profile.

It’s a pretty standard modus operandi for malware distributors, a new version of Flash seems to be a very common theme amongst these kinds of worm.

It seems like quite a lot of thought has gone into the design of this worm and due to the pretty slick distribution method it might become quite a large scale infection. It’s endgame is to create some kind of botnet and to steal the real information of value (banking details, credit card numbers etc).


The page prompts the user to install a new version of Adobe Flash. Users who agree are redirected to a download site for the file setup.exe, which is the new Koobface variant. Trend Micro detects the worm as WORM_KOOBFACE.AZ, and reported March 1 that its researchers had seen more than 300 unique IP addresses hosting the .exe file.

Trend Micro is expecting to see more.

“We’re only flagging a few hits at the moment, but the complexity with which this threat has been created shows how much work has been done to social-engineer social networks with the end game of creating [botlike] accounts to send out third-party links to almost anything,” said Jamz Yaneza, a threat researcher at Trend Micro.

The latest iteration of the worm runs on Windows 98, ME, NT, 2000 and XP and Server 2003. It sends and receives information by connecting to several servers, allowing hackers to remotely execute commands on a compromised machine.

Once infected the malware will search the users machine for Cookies from other social networking sites such as MySpace.com, Hi5 Networks, MyYearbook.com and Bebo.

As always, warn whoever you know that might use Facebook and generally tell people not to install or run anything that they aren’t expecting or didn’t specifically look for.

If they want to update Flash tell them ONLY to ever do it at the Adobe site.

Source: eWeek

Posted in: Exploits/Vulnerabilities, Malware, Web Hacking

, , , , ,


Latest Posts:


Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
HiddenWall - Create Hidden Kernel Modules HiddenWall – Create Hidden Kernel Modules
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers.
Anteater - CI/CD Security Gate Check Framework Anteater – CI/CD Security Gate Check Framework
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of filenames, binaries, deprecated functions, staging variables and more.


5 Responses to Koobface Worm Variant Hits Facebook

  1. Mafiya March 3, 2009 at 11:24 am #

    Any knowledge on how to get rid of it yet? Not that i have it, just that i work on computers, and we remove viruses. Would i do the Malwarebtyes, SuperAntiSpyware, HiJackThis, CCleaner? Or would that not get rid of it?

  2. Bogwitch March 3, 2009 at 6:42 pm #

    @Mafiya.

    No experience of it myself, but as with any other trojan, the safest way would be a complete rebuild of the workstation, unless you keep computational hashes of all the executables on your customers drives for comparison to ensure they have not become infected. Or are you peddling fixes that cannot be verified?

  3. Mafiya March 3, 2009 at 8:45 pm #

    Most customers are below 18, as i’m at a school. And we do it for free, just to gain experience. And what do you mean a complete rebuild? Just a clean install?

  4. Anonymous March 4, 2009 at 5:38 am #

    Mafiya: Bogwitch does mean a complete reinstall of the operating system(s). As it technically isn’t spyware/adware, your mileage may vary using only the tools you’ve specified. Solid antivirus software _should_ be enough, but it’s far better to never get infected in the first place.

  5. masterstyles March 25, 2009 at 11:08 pm #

    search for combofix , we use it a 1000 times a day, better than ur method, use it then mbam then ccleaner :)