Net.Worm.Koobface.ld Description

Net.Worm.Koobface.ld is a computer worm designed to enter a system and gather as much financial and personal information data as possible, before sending this information to an unauthorized remote user. Net.Worm.Koobface.ld spreads by targeting people using social networking websites, such as Facebook and MySpace, sending these users messages containing harmless subject matter, but redirecting the user who opens the message to a thid-party domain, unaffiliated with the social networking website, where they are prompted to download what is suggested as being an update to Adobe Flash player. Choosing to download this file, actually downloads Net.Worm.Koobface.ld onto the computer.

Type: Worms

How Can You Detect Net.Worm.Koobface.ld?

Net.Worm.Koobface.ld Technical Report

As new Net.Worm.Koobface.ld details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Net.Worm.Koobface.ld files with its MD5s were created in the system:

Net.Worm.Koobface.ld has typically the following processes in memory:

• ld09.exe
• ld10.exe
• freddy45.exe
• pp10.exe
• freddy46.exe
• freddy44.exe
• higeorge12.exe
• ld08.exe
• mstre19.exe
• freddy42.exe
• freddy43.exe

Net.Worm.Koobface.ld creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ pp
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ syshitray2
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ sysldtray
• RUNNING PROGRAM\pp10.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ sysfbtray
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ sysmstray

Important Article Disclaimer