Malware


Poison Ivy Variant Changes Benign Code to Malicious After Download

Trojan downloaders are the cannon fodder of the malware world: expendable, commoditized foot soldiers with a single function. Once their job is complete–downloading the executable or other malicious component–the downloaders are no longer useful. However, researchers have found that there are now some pieces of malware that are downloading not explicitly malicious pieces of code, but small bits of code that are benign on their face, but are then transformed into malicious instructions once they’re on the target machine.


By Stefan TanaseJust as a stand-up comedian carefully places his punch line at the end of the joke, I also usually leave my conclusions for the end of a post. Except for this time. This time, I would like to start with the conclusion: For an ongoing investigation not to be jeopardized, it is extremely important that all information related to those being investigated does not become public.

The crew behind the Koobface worm, who have been quite open about their exploits and financial gains from their work in the past, now seem to be ducking underground as pressure is building on them in the wake of exposures of their operation and real identities. The command-and-control server used to run the Koobface botnet, known as the Mothership, is now offline and new infections seem to have dropped off, experts say.

The individuals allegedly responsible for wreaking havoc on Facebook with the infamous Koobface botnet are living lavishly, blatantly flaunting their ill-gotten gains and taking little precautions to cover their tracks. Their locations, travels, business ventures, social media personas, Internet and real-life identities are apparently well-documented, but no one seems to be able to do anything about it.