New Socelars malware aimed at attacking Windows systems

New Socelars malware aims to attack Windows system to steal Facebook ad account

The type of malware that steals data from the victim's machine, or Infostealer, is one of the most popular malware among many modern-day hackers, and causes so serious data leakage that billions of passwords have been stolen with this type of malware. This is another new malware that Windows users need to be aware of.

According to a report by the website, Cyberpress has mentioned the detection of a new Infostealer malware called Socelars. The malware focuses mainly on attacks on Windows users with the aim of stealing Session data, accessing web browsers to access online accounts, without the need for a login password. The main targets that the malware wants to steal are Facebook Ads Manager accounts, to use the victim's account to shoot ad fraud, smuggle money filled in the account, or to remove it. Access is resold to another group of hackers to make a profit.

In the area of malware, a research team from AnyRun, a company that develops anti-malware tools, has revealed that the malware will be a software for reading PDF files such as "PDFreader." If the victim accidentally installs the fake software instead of installing the usual software, the fake software creates a folder called "pdfreader2019" and immediately starts stealing data on the machine by starting to attack web browsers on the machine, such as Chrome and Firefox, to read files related to cookies, such as databases (Database), SQLite Cookies to retrieve Session Cookies, Access Token, and Identifier to access online accounts without logging in. After that, the malware will use the stolen data to steal the information on the Facebook account, covering from Account ID, Spending Limits, Email, Page Information and Payment Methods used by the victim, such as Paypal and Credit Card.

As for the technical work of the malware, the research team revealed that the malware will start by exploring the system Reconnaissance and monitoring the environment of the system, followed by increasing the system Privilege access rights, being monitored by the UAC Account Control Protection System with the use of the COM Auto-Elevation technique. This will allow the malware to upgrade automatically through cmlua.dll and ICMLuaUtil. The malware will then create a Mutex called "patatoes" to prevent two rounds of redundancy, and then make contact. With a URL called iplogger [.] org to use to check the IP number and then freeze itself. Crash is similar to the application failed to deceive the victim's monitoring system and perform the above steps.

The research team also introduced the following methods of monitoring and preventing such malware.

Avoid using strange applications like "PDFreader" by instead using tools from well-known developers like Adobe or Foxit.

Use Policy to access the most rigorous cookies-related files, as well as use Endpoints to keep an eye on them.

Turn off UAC's automatic permissions upgrade system and scan for a Mutex called "patatose."

Use the Simulated Environment System or Sandbox to check suspicious files before activating them every time.

Update patches on Windows and web browsers regularly to plug leaks, adding security to the system.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # it