TrendLabs Malware Blog
Glossary
TrendWatch
TrendLabs Twitter
WORM_KOOBFACE.EY
Overview

Malware type: Worm

Aliases: No Alias Found

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 98, ME, NT, 2000, XP, Server 2003

Encrypted: No

Overall risk rating:


Reported infections:

Damage potential:

High

Distribution potential:

High

Description: 

To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.

WORM_KOOBFACE.EX Behavior Diagram

Malware Overview

This worm has received attention from independent media sources and/or other security firms.

This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It searches for cookies created by certain social networking Web sites. Once cookies related to social networking Web sites are located, it then connects to these Web sites using the user login session stored in the cookies. It then navigates through pages to search for user's friends. If a friend has been located, it sends HTTP POST request to the server. As a reply, the server sends data which is actually the message to be sent to user's contacts. It then composes a new message containing the data from the server and sends it to the user's friend.

The new message contains a link where a copy of this worm can be downloaded.

For additional information about this threat, see:
Solution
Technical Details

Description created: May. 20, 2009 5:37:10 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.