New Malware Steals Facebook Account Information

A new kind of malware, whose purpose is to steal Facebook credentials, has appeared. On an infected system, this malware steals web browser information, as well as the credentials of the user's Facebook account.

When executed, it displays a fake notification window to the user, as shown in [Figure 1]. The notification window tells the user an application called "Easy Backup" must be reinstalled because the configuration file does not exist. While the window is open, the malware performs malicious actions without the user’s knowledge.

 
[Figure 1] Fake notification window displayed to deceive the user

The malware pauses svchost.exe, a Microsoft process that manages system services, and inserts itself into the memory of the process file to execute itself. Then, it deletes itself from everywhere but this location.

The malware checks for specific parameter values to avoid detection. If conditions are not met, it terminates itself. Another case it will terminate itself is if a specific file (INI) exists in the %APPDATA% path. It does this in order to prevent duplicate execution.

However, when the specific parameter values are met, the malware collects data from the web browser installed in the infected system. Almost every type of local file in the web browser system, such as Chrome, Firefox, Internet Explorer, and Edge, will be searched. 

Once it finishes searching the Web browser information, the malware collects the web browser account data files and attempts to hack account information. The malware gathers basic information from the system and the account data stored in the web browser. It also collects the system’s IP address with a specific URL and exfiltrates information to a C&C server. 

This malware is characterized by sending stolen information to a C&C server, as well as stealing Facebook credentials from infected systems. As shown in [Figure 2], the malware establishes a connection to a Facebook session after finding the Facebook authentication cookies stored in the infected system.

Using the discovered cookie file from the local system, the malware accesses Facebook and uses the Facebook Graph API (an API interface for querying data from the Facebook's social graph) to steal a user’s Facebook credentials.

It appears that the malware attempts to acquire more information via Facebook advertisement campaigns, which suggests that the malware targeted advertisers on Facebook.

The malware sends the unique user ID and the harvested system information to the attackers via a specific URL and generates an INI marker file in the %APPDATA% path to prevent duplicate execution attempts and terminates itself.

- Trojan/Win32.Agent

- Trojan/Win32.Injector