A new Python malware, SolyxImmortal, aims to steal code.

A new Python malware, SolyxImmortal, aims to steal passwords and loud browser cookies.

According to a report by the website, Cyber Press has mentioned the detection of a new type of Infostealer malware called SolyxImmortal. This malware was created in Python. It has the ability to steal a lot of data, such as the victim's Sensitive Data, the data on the Chromium family of web browsers, and the victim's Keystroke. A research team from Cyfirma, a cybersecurity specialist company, said that the malware has been used by Discord's famous chat service Webhook in data extraction (Exfiltration), making it difficult to detect, and when it is searched, the malware is focused on playing. The task is mainly Turkish, because the fixed keyword (Harcoded) is set. If the defined Turkish word is detected, the malware will automatically save the screen (Screenshot) of the Gmail or bank website.

As part of its technical work, malware has implemented up to 15 Module in Python, such as OS Interaction, Threading, and Cryptography Libraries, so that the malware can run at full capacity. After the malware starts embedding, the malware creates persistence on the system by copying itself to the APPDATA folder (especially the WindowsGraphics folder) immediately, then modifying the Registry Key called CurrentVersion Run to ensure The malware will run automatically every time the victim logs into the machine.

For the preparation of exporting data, the malware will create a temporary folder specifically named Solyx _ Pack _ Final in the TEMP folder, and then extract the Decryption Key from the local state files of the Chromium family of web browsers to extract passwords saved on the web browser in Plain Text from the SQLite database. These passwords will be saved in the file name "sifreler.txt." In addition, the malware was found to be capable of stealing Cookies database data from the Firefox web browser and can steal PDF, Doc documents. , and Spreadsheet. For easy smuggling, do not cut off the timeout. The malware focuses on stealing files of 100 Bytes - 100 MB only without interfering with the System folder.

In addition to these data, the research team also found that the malware secretly traps the typing of all-character victims. These data are stored in Buffer memory. The captured data is combined into JSON files and then exported to the malware infrastructure located on the Discord chat service every 60 seconds. Not only that, the malware has the ability to save Screenshots when the Turkish Keyword is found to match an email or a bank website. These image files are sent to the malware server immediately with an Alert Message notification to hackers to view the stolen data. Also,

# python # Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack