Watch out for fake Telegram web.

Beware Fake Telegram Web, Instantly Download Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Install Install Install Install Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Instant Inst

One of the most popular chat applications used by people who wanted data security would not escape Telegram, and it was used to emit malware on victims.

According to a report by the website, Cyberpress has mentioned the detection of a malware in the form of memory (In-Memory) through a fake Telegram website. This website is called telegram [.] com (observed to be different from the actual website used .org). The website is almost exactly the same as the genuine Telegram website, and the victim is persuaded to download a file that claims to be a file for the installation of the Telegram application. The file is called tsetup-x64.6.exe, which is also similar to the installation file of the genuine application, so that the victim is usually not Eh, mind.

But after running to install the application successfully, it will lead to the embedding of complex multi-stage Infection malware, starting with a Command to detect certain processes, such as 0tray.exe, to determine if the machine has Anti-Virus installed on it, and a PowerShell script to add every System Drive to the Exclusion List of Windows Defender, so that the malware can run conveniently without being detected on the excluded drive.

After that, the malware runs a malware DLL file called AutoRecoverDat.dll through rundll32.exe, which is a tool for running Windows-built DLL files to decode the last payload from an XML file called GPUCache.xml, create an Executable file in Portable Executable (PE) via Runtime, and then run directly on memory.

When running on memory successfully, the malware will make contact with the control server (C2 or Command and Control) located on the IP number 27.50.59.77 via port 18852. The IP number has a part to do with the domain of the fake application - jiijua [.] com, telegrgam [.] com, telefgram [.] com, and tejlegram [.] com. This connection will allow hackers to send commands, update new payloads, and ensure that they are always contacted for malware commands (Persustent) through the channel to ultimately take control of the victim's machine.

# Trending # Lemon 8 Howtoo # lemon 8 diary # telegram # freedomhack