New Koobface worm variant (Aug 11, 2009)

SonicWALL UTM Research team found a new variant of Koobface worm last week on August 7, 2009. It’s packed using UPX.

There are three major enhancements in this new variant of Koobface,

a) Earlier drive-by sites had a page that looked like YouTube video page but now they have switched to a Facebook video look-alike page.

b) In past, the message tweeted was “My home video 🙂 [URL]”, now they randomize it by adding “LOL”, “HA-HA-HA”, “OMFG!” etc, so each tweet is unique.

c) The link is also unique with an appended random number, so after URL shortening it is still unique:
hxxp://uppinorr.se/pub1icm0vies/?[RANDOM] -> hxxp://bit.ly/[RANDOM]

The malware performs following activities upon execution:

• Deletes the original file that was downloaded and executed by the user
• Drops files (Windows)ld12.exe, (Windows)prxid93ps.dat and executes ld12.exe
• Creates a registry entry to ensure that it starts on system reboot:
  HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunsysldtray: “c:windowsld12.exe”
• Checks for Internet connectivity by sending GET request to www.google.com
• If Internet is available, it connects to the C&C server located at upr0306.com and receives command to download malicious files:

  #PID=1000
  STARTONCEIMG|http://web.reg.md/1/p.jpg
  STARTONCE|http://web.reg.md/1/prx.exe [Detected as GAV: FakeAv.OT_2 (Trojan)]
  START|http://web.reg.md/1/pp.10.exe [Detected as GAV: Koobface.NBH_5 (Worm)]
  #BLACKLABEL
  EXIT

This malware is also known as Worm:Win32/Koobface.gen!D [Microsoft], Net-Worm.Win32.Koobface.bgr [Kaspersky], Mal/KoobHeur-A [Sophos].

SonicWALL Gateway AntiVirus provides protection against this malware via GAV: Koobface.BGR (Worm) signature.

Screenshots of Koobface worm drive-by sites in action can be seen below:

Facebook video page look-alike:

Download of the Koobface worm when user attempts to download flash player:

Page showing unique tweets with shortened malicious link:

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.