Threat Encyclopedia

Win32/Koobface.NCF is a worm that spreads through social networking sites. The file is run-time compressed using UPX . When executed, the worm copies itself into the following location: In order to be executed on every system start, the worm sets the following Registry entry: The following Registry entries are set: The following Registry entries are created: The following Registry entries are removed: The worm checks for Internet connectivity by trying to connect to the following servers: If no Internet connection is detected, the worm deletes itself.

The worm connects to the following addresses: The worm searches for cookies with login sessions related to social networking sites. The following social networking sites are affected: If the worm finds the appropriate cookie, its content is sent to the following remote computer: The worm then obtains data and instructions for further action.

The worm spreads by sending messages to people that are "friends" with someone in the social network whose computer has already been infected.

The message contains a URL link to a website containing malware.

If the link is clicked a copy of the worm is downloaded. Some examples follow.

Example (1.) : Example (2.) : Example (3.) : Example (4.) : The worm creates the following files: The worm may attempt to download files from the Internet. The HTTP protocol is used.

These are stored in the following locations: A string with variable content is used instead of %filename% .