Koobface continues to mutate in the search for dollars

wormWe have detected, yet another variant of the Koobface worm.  This variant, detected as W32.Koobface.C, installs the misleading application detected as AntiVirus2008, and is propagating on Twitter.

Now, this worm is not new, since it was discovered last year in August 2008, but it has come back again to spread on Twitter.  Response analysis and investigation into this attack has confirmed that this new version of Koobface contains functionality to search for users who have Twitter accounts. If Koobface finds a suitable user (by searching for Twitter cookies), then it will contact a command and control server which will then send down a version of Koobface which contains functionality to log into Twitter and add a tweet to the victim’s account. We also believe that it looks for cookies for other social networking sites.

When the user clicks the link, they are redirected to a fake video web site, then asks the user to download a codec to watch the video.  This codec is a copy of W32.Koobface.A. and this then downloads the misleading application detected as AntiVirus2008. So, at the end of the day, the guys that are peddling this attack are trying to see if they can make money on the back of it.

What you can do to protect yourself is careful what you click on – we advise Twitter users to avoid clicking URLs on tweets, especially if the tweet advertises a home video. Additionally, arm yourself with strong and updated security software to catch and prevent malware from downloading.

July 15, 2009 | Filed Under Security 

comments

Leave a Reply