Microsoft warns to beware of VBS-style malware from Whatsapp

Microsoft warned against VBS-style malware from Whatsapp that could break through UAC's protection systems, taking over the machine.

Whatsapp is a popular chat application on a global scale, which, of course, is used around the world, will cause a lot of victims for hackers to take on the case eventually.

According to a report by The Hacker News website, Microsoft has alerted users to VBS malware sent through the popular chat application Whatsapp. This malware was able to enter the UAC protection system during the upgrading of the malware's access to the system. This malware has been detected by the Microsoft research team in February.

For access to the victim's machine, hackers use a social engineering method in combination with the tools already available on the system (Living-off-the-Land) to release malware into the victim's machine. Although it is not clear how hackers deceive the victim, it is clear that the hacker will start by contacting the victim via WhatsApp and deceive the victim to download the VBS script file. After running the script, the script will create a Hidden Folder in a folder called "C: ProgramData" and paste the real Windows Utilities file. ) named "curl.exe" (which was renamed "netapi.dll") and "bitsadmin.exe" (which was renamed "sc.exe") into the aforementioned folder.

After that, the malware will start to create persistence on the system and download the second payload file in the MSI file format by pulling down the second VBS script from the trusted services that hackers have deposited, such as AWS S3, Tencent Cloud and Backblaze B2. After all the steps are done, the malware will start running the Privilege command through cmd.exe, running continuously until the UAC upgrade is successful. If not done, it will be forced to close and rework. After the success, the malware will modify the Windows Registry in the HKLMSoftwareMicrosoftWin section to ensure that the malware will be rebooted every time the system is rebooted. After everything is done, the malware will continue to act as an exfiltration.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # whatsapp