Pick Your Poison: Koobface Or Fakeav?

[Peaches]

Pick Your Poison: KOOBFACE or FAKEAV?

by Jonell Baltazar (Advanced Threats Researcher)

"The Koobface botnet is widely known to install FAKEAV or rogue antivirus malware onto a victim’s PC. It has a dedicated component which actually installs the FAKEAV onto the user’s system. However, the Koobface gang has added a new twist to its fake Facebook page.

When the user closes the window/tab with the fake Facebook page, a popup window appears. Whatever button the user clicks, this new Koobface variant is downloaded onto the affected system. Here’s a video that illustrates this behavior:"

Details & screenshots – Trendlabs - http://blog.trendmicro.com/