JS_KOOBFACE

KOOBFACE malware are known for targeting the social networking site Facebook to spread via infected wall posts. It was first spotted in 2008, but KOOBFACE was at the height of its operations in 2009 and 2010.

While the name suggests that this family uses Facebook to spread, its variants were also known to use other social networking sites like Twitter and Myspace. It uses social engineering to get users to click on a link that appears to lead to a video. The video is fake but is hosted on a site that imitates YouTube. The site then gets users to install a file to view the video, but the file is actually the malware.

KOOBFACE malware are made up of several key components to complete its routine. The components consist of data stealers, downloaders, DNS changers, among others.

KOOBFACE may steal system information and user credentials, download other malware, and open a backdoor on the affected system. Some variants of this malware family have been linked to FAKEAV distributors. Newer variants employed traffic direction systems.

Installation

This Trojan drops the following files:

• %System%\clbcoko.dll
• %System%\drivers\imapioko.sys
• %System%\drivers\mrxoko.sys
• %System%\erokosvc.dll
• %User Profile%\Local Settings\Application Data\{Random CLSID for Firefox}\chrome.manifest
• %User Profile%\Local Settings\Application Data\{Random CLSID for Firefox}\chrome\content\timer.xul
• %User Profile%\Local Settings\Application Data\{Random CLSID for Firefox}\install.rdf
• %User Temp%\tmp

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %System Root%\Documents and Settings\All Users\Application Data\mplf\mstime32.exe
• %User Profile%\Application Data\SystemProc\lsass.exe
• %User Profile%\Application Data\system\svchost.exe
• %User Profile%\Application Data\system\verona\copy
• %User Profile%\Application Data\system\verona\load_me.exe
• %Windows%\ld03.exe
• %Windows%\ld04.exe
• {malware folder}\{malware file name}.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Windows% is the Windows folder, which is usually C:\Windows.)

It creates the following folders:

• %System Root%\Documents and Settings\All Users\Application Data\mplf
• %User Profile%\Application Data\SystemProc
• %User Profile%\Application Data\system
• %User Profile%\Application Data\system\verona
• %User Profile%\Local Settings\Application Data\{Random CLSID for Firefox}
• %User Profile%\Local Settings\Application Data\{Random CLSID for Firefox}\chrome
• %User Profile%\Local Settings\Application Data\{Random CLSID for Firefox}\chrome\content

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
sysldtray = "%Windows%\ld03.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
sysldtray = "%Windows%\ld04.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
RTHDBPL = "%User Profile%\Application Data\SystemProc\lsass.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Intel Management Services v32 = "%System Root%\Documents and Settings\All Users\Application Data\mplf\mstime32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{random CLSID}
StubPath = "%System Root%\Documents and Settings\All Users\Application Data\mplf\mstime32.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
wupd32 = "%User Profile%\Application Data\system\svchost.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
xMyDate

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{random CLSID}

HKEY_CURRENT_USER\Software\verona_4l

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ql600oko

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\swoko

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\apto6ko

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\cpqoko6

It adds the following registry entries:

HKEY_CURRENT_USER\Identities
Curr version = "{number}"

HKEY_CURRENT_USER\Identities
Last Date = "{date}"

HKEY_CURRENT_USER\Identities
Inst Date = "{date}"

HKEY_CURRENT_USER\Identities
Popup count = "{number}"

HKEY_CURRENT_USER\Identities
Popup time = "{number}"

HKEY_CURRENT_USER\Identities
Popup date = "{number}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Program Files%\internet explorer\iexplore.exe = "%Program Files%\internet explorer\iexplore.exe:*:Enabled:Internet Explorer"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
TI = "{number}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
TP = "{number}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
termsvc = "{hex value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
tapisrvs = "{hex value}"

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}2009.biz
• {BLOCKED}2009.biz
• {BLOCKED}ar09.info
• {BLOCKED}osma.com
• {BLOCKED}nse26032009.com
• {BLOCKED}trol.com
• {BLOCKED}pages.com
• {BLOCKED}32009.biz
• {BLOCKED}32009.biz
• {BLOCKED}0603.com
• {BLOCKED}n.com
• {BLOCKED}z.com
• {BLOCKED}an.net
• {random}.{BLOCKED}orked.com
• {random}.{BLOCKED}ndyew.com
• {random}.{BLOCKED}rkedya.com
• {random}.{BLOCKED}ctya.com
• {random}.{BLOCKED}tedya.com
• {random}.{BLOCKED}ntedya.com