Home / malware

PDF

Net-Worm:W32/Koobface.CY

First posted on 10 December 2008.
Source: SecurityHome

Aliases :

There are no other names known for Net-Worm:W32/Koobface.CY.

Explanation :

A type of worm that replicates by sending complete, independent copies of itself over a network.

right]This malware is installed via a fake YouTube webpage (where it is posing as a Flash player update) displayed by Net-Worm:W32/Koobface.CZ.

The purpose of this malware is to post comments with HTML links in various online networking locations in order to spread itself.

Upon execution, the worm will create these files:

• %windir%olivar28.exe
  copy
  
• %windir%fmark2.dat
  data file
• c:1.reg
  contains a routine to add entries to the registry
• c:64234543.bat
  cleanup routine

It will also display this fake error message:



The malware will then add this entry to the registry so that it will already be capable of inserting an HTML page into another HTML page, which can be useful when inserting comments in user pages inside networking sites.

• HKEY_CLASSES_ROOTMimeDatabaseContent Typeapplication/xhtml+xml
  "CLSID"="{25336920-03F9-11cf-8FD0-00AA00686F13}"
  "Extension"=".xml"
  "Encoding"=hex:08,00,00,00

Then, it will send an HTTP POST message to this location in order to retrieve the information that it will post as comment:

• http://y171108.com/[...]/first.php

The site also contains the the malware download location.

The following sites are referenced in the body of Koobface.CY:

• bebo.com
• blackplanet.com
• facebook.com
• friendster.com
• myspace.com
• myyearbook.com

The routines in Koobface.CY directly target Facebook and the other sites are not used by this variant.

Koobface.CY contains a routine to connect to these locations:

• http://y171108.com/[...]/logs.php
• http://y171108.com/[...]/gen.php

The gen.php location contains the comments that are posted to different websites.

Koobface.CY is packed with UPX.

Last update 10 December 2008

 

TOP