+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: [Warning] The "LOL" Facebook message infection [.jar dropper | CPU Miner | Keylogger] (/showthread.php?tid=4239565)
The "LOL" Facebook message infection [.jar dropper | CPU Miner | Keylogger] - Aura - May 20, 2014
![[Image: XhL7THr.png]](https://i.imgur.com/XhL7THr.png)
Hey guys, Aura here with yet another warning.
Recently, a new malware came up on Facebook. This malware is sent in a Facebook message that contains "lol" and a link to a .zip attachement that is named "IMG_xxxx.zip". The message can also contains "OMG" or "Have a look at this", even "I can't believe someone posted this" (back in the days of MSN). INside the .zip is a file named "IMG_xxxx.jar". For those who do not have the "Hide file extensions for known extension type" on Windows, they won't notice that the file is actually a .jar (executable Java file) and not a .png, .jpg or any other popular picture format. This .jar isn't the main malware but a downloaders/dropper that downloads the malware from a Dropbox shared folder and then installs it on the victim's computer. This malware install itself as a service, therefore it is very persistant. Also, this malware will then spread throught the victim's Facebook friend list using the same kind of message the victim got infected by in the first place. Therefore this file is asumed to be a worm but also a CPU Miner from what the last report from users in the White Hat Help section says. This malware have been identified as a variant of the Zusy Trojan that usually hooks itself into web browsers in order to steal personal information, mostly credit card numbers and other financial data.
If you come across one of these message and file, please warn the person that sent it to you that he'S infected and should get his system checked up immediately.
I'm posting this as I recently assisted a user with this issue in the White Hat Help section. The malware isn't hard to remove for experienced malwares removal members like myself, Maitricks, Arr, Null Byte, etc. but can be a bit tricky for people who never faced this kind of malware.
Once again please keep in mind to always use an Antivirus at all time and also to now download anything fishy from the web and ALWAYS verify your downloads in Sandboxie or a VM before using them on your host system.
Original article on TheHackersNews : LOL, Jar File Malware Just Goes Viral Through Facebook Messages
Thank you and stay safe everyone.
* - ShadowWolf - May 20, 2014
Good to know, will be more careful on facebook now. Not that I am not careful anyway.
* - RƎDSPY - May 20, 2014
Sometimes I download those on purpose to see what it will do.
I run it in sandboxie.
* - Aura - May 20, 2014
(May 20, 2014 12:50 PM)legend7 Wrote: Make sure you have Sandboxie set to deny Internet access. It could be stealing login information.
I don't have this settings on my Sandboxie as I run it in a VM where no passwords or login have ever been stored so it allows me to push the tests a bit more far.
* - Jagster™ - May 20, 2014
Tell me how to check for it and how to remove (not for me but for others :P ), that way you won't have 1k check-up requests :)
* - Aura - May 20, 2014
(May 20, 2014 01:03 PM)Jagster™ Wrote: Tell me how to check for it and how to remove (not for me but for others :P ), that way you won't have 1k check-up requests :)
Shit, I should really start to create documentation on every new malwares I remove and then send it to you guys 🤣
* - Aura - May 20, 2014
(May 20, 2014 01:05 PM)legend7 Wrote: I do the same. Although I think my Windows 7 VM just expired. 😟
Also, I remember a few years ago when there was a worm spreading through Skype that did essentially the same thing as this. It sent messages that said "hey is this your new profile pic <insert link to .exe disguised as a picture here>".
You don't have to activate a Windows VM lol. Mine are all expired and I don't care.
* - Aura - May 20, 2014
(May 20, 2014 01:10 PM)legend7 Wrote: I think they went from requiring activation to just trying to annoy you into activating but not actually making it mandatory. 😝
Yeah you just click "Skip" and "Activate later" and it leaves you alone so it's not that bad.
* - Dr. Manhattan - May 20, 2014
Yeah i've got friends that were also infected by this kind of malware. I really can't help them in removing it, i just warm them about what they are facing now : (
* - Aura - May 20, 2014
(May 20, 2014 01:14 PM)Dr. Manhattan Wrote: Yeah i've got friends that were also infected by this kind of malware. I really can't help them in removing it, i just warm them about what they are facing now : (
Tell them to sign up on HackForums and head straight up for the MRT section ?
* - ShadowWolf - May 20, 2014
(May 20, 2014 01:04 PM)Aurа Wrote: Shit, I should really start to create documentation on every new malwares I remove and then send it to you guys 🤣
Perhaps someone should create a thread where people post new malware they find and how they have solved it. That way people trying to expand their knowledge could go and learn new methods or how to to identify certain malwares.
* - Aura - May 20, 2014
(May 20, 2014 01:52 PM)ShadowWolf Wrote: Perhaps someone should create a thread where people post new malware they find and how they have solved it. That way people trying to expand their knowledge could go and learn new methods or how to to identify certain malwares.
The thing with this thread is that only allowed and recognized helper like me should be trusted. We would have to manually verify all the other methods posted.
* - Motix - May 20, 2014
Thanks for notifying, I'll be more careful and I'll also notify people I know about this so they won't fall for this. Thanks again! :)
* - grady - May 20, 2014
There is actually the same type of thing but for Skype.
I had a friend infected by it.
* - Aura - May 20, 2014
(May 20, 2014 01:58 PM)iOhh Wrote: Thanks for notifying, I'll be more careful and I'll also notify people I know about this so they won't fall for this. Thanks again! :)
No problem buddy, stay safe.
(May 20, 2014 02:10 PM)๖ۣۜInfamy Wrote: There is actually the same type of thing but for Skype.
I had a friend infected by it.
I guess the worm has been modified to it spreads through other means. Facebook and now Skype as well.