Threat Database Worms Net-Worm.Win32.Koobface.iap

Net-Worm.Win32.Koobface.iap

By Domesticus in Worms

Threat Scorecard

Ranking: 8,073
Threat Level: 80 % (High)
Infected Computers: 2,100
First Seen: August 17, 2011
Last Seen: August 23, 2023
OS(es) Affected: Windows

Sometimes the name given or assigned malware can be quite telling. For instance, Net-Worm.Win32.Koobface.iap at a glance warns PC users and the Internet security community that this virus is a 'worm' and specifically targets systems running the 'Win32 platform'. Equally important is its reference to the infamous 'Koobface' vermin, known for propagating on the friendly social network platform Facebook, Twitter and MySpace, to name a few.

Koobface was planed, originally, to infect Microsoft Windows and Mac OS X and in a limited capacity, Linux. Friendly PC users would intercept a spoofed and manufactured message routing them to a malicious website so they can view some video or movie. The trap was the fake Adobe Flash update, which people get fooled with in order to watch a video or movie, but instead it downloads the infectious Koobface. Once inside, Koobface would set the attack, hijacking the browser and globally changing proxy settings.

Long gone are the days of simple malware that poked fun only and temporarily disrupted use of an aggravated victim's system. A well-planned malware (aka Trojan, worm or a malicious program) can be used to wage cyber-political warfare, cyber-heists, cyber-theft or robbery, cyber-rape (i.e. of vital data), or any low-level crime possible in the real world. Technology has made it easier to store, manipulate and ultimately access all forms of data that literally run millions of organized businesses and lives around the world. Basically, where there is money, there is crime and evil lurking about.

Cybercriminals are exploiting hardware and software vulnerabilities and use social engineering to manipulate the habits of man. Koobface and the variant Net-worm.Win32.Koobface.iap explores the vulnerability and breaches the trust of social networks. An unprotected or poorly secured PC quickly becomes a nest of infestation after Net-worm.Win32.Koobface.iap is downloaded.

Worms are known to replicate and send copies of themselves via email to everyone on a victim's contact list and may search for other nodes to infect such as thumb drives or other external drives. Net-worm.Win32.Koobface.iap may build a P2P botnet, so the comprised computers may receive P2P commands. Equally key is collecting data stored in your cache, recorded from spying on your surfing habits or logged system data, so it can be transferred to a remote server.

While Net-worm.Win32.Koobface.iap is usually propagated through social network channels, Net-worm.Win32.Koobface.iap can also be distributed using other channels, with or without the aid of a PC user. The rate of speed that a worm replicates is also a major concern, since malicious programs can cause a system overload or hard drive crash due to the amount of resources it uses. Therefore, time is of the essence in removing this worm.

File System Details

Net-Worm.Win32.Koobface.iap may create the following file(s):
# File Name Detections
1. %Windir%\gh5h166.exe
2. %AppData%\rdr_1312111036.exe
3. %Windir%\twps
4. %UserProfile%\UserData\index.dat

Registry Details

Net-Worm.Win32.Koobface.iap may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3921C115C15D0ECA5CCB5BC4F07D21D8050B566A
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5

Trending

Most Viewed

Loading...