Koobface

Koobface Botnet’s Scareware Business Model – Part Two

11 Nov 2009 By Dancho Danchev

UPDATED – Wednesday, November 18, 2009: A new update is pushed to the hundreds of thousands infected hosts, which is now performing the redirection using dynamically generated .swf files, with every page using the same title “Wonderful Video”. The redirection is also a relatively static process. For instance, if the original koobface redirector is koobface.infected.host/301,Read More

Koobface Botnet Redirects Facebook’s IP Space to my Blog

21 Oct 2009 By Dancho Danchev

Love me, love me, say that you love me. You know you’re cherished when the Koobface botnet redirects Facebook Inc’s entire IP space to your blog using HTTP Error 302 – Moved temporarily messages in an attempt to have Facebook’s anti-malware crawlers hit my blog every time they visit a Koobface URL posted on theRead More

Koobface Botnet Dissected in a TrendMicro Report

14 Oct 2009 By Dancho Danchev

I’d like to thank the folks at TrendMicro for mentioning the message inserted by the Koobface gang (more love on a first-name basis from them) within their command and control infrastructure for nine days, greeting me for systematically kicking them out of their ISPs, and suspending their command and control domains, in a new reportRead More

Koobface Botnet’s Scareware Business Model

16 Sep 2009 By Dancho Danchev

UPDATE1: TrendMicro just confirmed the ongoing double-layer monetization of Koobface. Meanwhile, the gang is rotating the scareware domains with new ones pushed by popup.php, followd by two recently updated Koobface components. The new scareware domains kjremover .info; lrxsoft .info – 212.117.160.21 – Email: niclas@i.ua actually download it from the well known q2bf0fzvjb5ca .cn portfolio, whichRead More

Movement on the Koobface Front – Part Two

19 Aug 2009 By Dancho Danchev

UPDATE13: The domain snimka31082009 .com has been suspended. Just like the domains listed in UPDATE11, it’s worth pointing out that once the PrivacyProtect.org whois records return to their original state, all of the domains are registered using the name Rancho Ranchev — from Ukraine with typosquatting. UPDATE12: A new Koobface domain is in circulation acrossRead More

Movement on the Koobface Front

04 Aug 2009 By Dancho Danchev

Now that the Koobface gang is no longer expressing its gratitude for the takedown of its command and control servers, the group has put its contingency planning in action thanks to the on purposely slow reaction of UKSERVERS-MNT’s (78.110.175.15) abuse department. Next to the regular updates (web.reg .md/1/websrvx2.exe; web.reg.md/1/ prx.exe), the group introduced two newRead More

Koobface – Come Out, Come Out, Wherever You Are

22 Jul 2009 By Dancho Danchev

UPDATE2: New binaries are hosted at web.reg .md/1/pdrv.exe; web.reg .md/1/pp.10.exe and at web.reg .md/1/fb.49.exe. UPDATE: The Koobface gang is upgrading the command and control infrastructure in response to the positive ROI out of the takedown activities. This of course doesn’t mean that enough evidence on “who’s who” behind Koobface and a huge percentage of theRead More

Unit-123.org E-shop Owner Information

Who is Dancho Danchev?

Unit-123.org

Focused on delivering daily batches of personally-produced never-ending supply of high-quality and never-published and released before classified and sensitive Intelligence Deliverables.

Latest Products