The latest W32.Yimfoca.B variants can target malicious links in no fewer than 44 countries and nearly 20 different languages. It has also increased the number of instant messaging applications (previously Yahoo! Messenger) to include the following popular IM clients:

  • Msn Messenger
  • Google Talk
  • ICQ
  • Paltalk
  • Skype
  • XFire

Here is a code snippet from W32.Yimfoca.B:

Blog1_1

This picks the desired messages based on a comparison with the full list of countries listed below:

·         Slovenia

·         Canada

·         Norway

·         Switzerland (German)

·         Switzerland (Romansh)

·         United Kingdom

·         Mexico

·         Belgium

·         Austria

·         Portugal

·         Australia

·         Spain (Modern)

·         Spain (Traditional)

·         Venezuela

·         New Zealand

·         Ireland

·         South Africa

·         Colombia

·         Peru

·         Argentina

·         Turkey

·         Pakistan

·         Indonesia

·         Ukraine

·         Belarus

·         Czech Republic

·         Denmark

·         Germany

·         Greece

·         United States

·         Finland

·         France

·         Israel

·         Hungary

·         Iceland

·         Italian

·         Japan

·         Korea

·         Netherlands

·         Polish

·         Brazil

·         Romania

·         Russia

·         Croatia

·         Slovakia

·         Albania

·         Sweden

·         Thailand

The full list of messages is:

·         mira esta fotografa 😀 [MALICIOUS LINK]

·         seen this?? 😀 [MALICIOUS LINK]

·         This is the funniest photo ever! [MALICIOUS LINK]

·         olhar para esta foto 😀 [MALICIOUS LINK]

·         Wie findest du das Foto? [MALICIOUS LINK]

·         se ps dette bildet 😀 [MALICIOUS LINK]

·         bekijk deze foto 😀 [MALICIOUS LINK]

·         poglej to fotografijo 😀 [MALICIOUS LINK]

·         pogledaj to slike 😀 [MALICIOUS LINK]

·         titta ps denna bild 😀 [MALICIOUS LINK]

·         pozrite sa na t

·         to fotografiu 😀 [MALICIOUS LINK]

·         uita-te la aceasta fotografie 😀 [MALICIOUS LINK]

·         katso tStS kuvaa 😀 [MALICIOUS LINK]

·         bu resmi bakmak 😀 [MALICIOUS LINK]

·         spojrzec na to zdjecie 😀 [MALICIOUS LINK]

·         nTzd meg a kTpet 😀 [MALICIOUS LINK]

·         ser ps dette billede 😀 [MALICIOUS LINK]

·         podfvejte se na mou fotku 😀 [MALICIOUS LINK]

·         guardare quest’immagine 😀 [MALICIOUS LINK]

·         regardez cette photo 😀 [MALICIOUS LINK]

When the worm doesn’t recognize the country, it uses a default message in English:

Seen this?? 😀 [MALICIOUS LINK]

Surely this will help with the success rate of its IM spreading capabilities, but it isn’t finished there…

W32.Yimfoca.B has also has the added capability to spread to any removable drives on C through Z. Upon initial infection, and every five minutes thereafter, W32.Yimfoca.B will attempt to infect removable drives inserted into the compromised computer.

When W32.Yimfoca.B infects these drives, it hides existing folders found on the removable drive, setting their attributes to ‘system’ and ‘hidden’, and replacing them with a shortcut link to a copy of the worm. The shortcut icon will be that of a folder, so a user may be fooled into thinking this is in fact the original folder.

Here is what a typical user will see if system files are hidden (which is the default):

Blog2_1

Here is what really exists on an infected removable drive:

blog3

The real purpose of the threat is to spread in order to download further malware on to your computer. At the time of analysis, this version of W32.Yimfoca.B is downloading W32.Yimfoca.