Koobface includes several components, including worm software that automatically tries to infect Facebook friends of the victims, and botnet code that gives the hackers remote control of the infected computer.

Koobface has turned out to be a pretty lucrative business since it first popped up on Facebook in July 2008. In a , Villeneuve says that the botnet made more than US$2 million between June 2009 and June 2010.

Researchers found data stored on another central server, called "the mothership" used by the Koobface gang to keep track of accounts. This server sent daily text messages to four Russian mobile numbers each day, reporting the botnet's daily earnings totals. Revenue ranged from a loss of $1,014.11 on Jan. 15 of this year to a profit of $19,928.53 on March 23.

Payments were made to Koobface's operators through the Paymer payment service, similar to eBay's PayPal.

The gang's creators would use their hacked computers to register more Gmail, Blogspot and Facebook accounts and steal FTP (File Transfer Protocol) passwords. They also messed up their victims' search results to trick them into clicking on online ads, generating referral money from advertising companies. More cash came from fake antivirus software that Koobface can sneak onto victims' PCs.