If you come across a suspicious message on Facebook that says “LOL,” and contains a supposed image, avoid clicking on it. The message usually comes from your Facebook friends who are already victims of the malware included as an attachment.
The Trojan is known in Greece, as we had revealed it two weeks ago (here and here), and as we had mentioned at the time, it was developed by Greek or Greek developers.
This time we did not have the virus in our hands to analyze it, but according to the photo published by The Hacker News, the malicious user who wrote the malware is Greek.
See the photo of the code
The Greek references (RixtoKato to Spiti Tou Pepe) refer to the way the programmer who wrote the viruses we had previously published writes.
Malware can steal your Facebook account information.
The Trojan started spreading through Facebook’s Messenger service and pretends to come from a friend. It mentions a simple “LOL” to pique the recipient’s curiosity and contains a zip file that appears to be a photo named “IMG_xxxx.zip.”
If a Facebook user opens IMG_xxxx.zip, they will discover a Java file: “IMG_xxxx.jar”. The Jar file itself is not a virus, but a malware agent, which actually starts downloading a file from a pre-defined Dropbox account (as shown in the code). After downloading, the malware installs itself as a service on the victim’s system. It then starts spreading to the victim’s friends, automatically sending similar malicious messages in the background.
To avoid detection by security software, the malware is injected into legitimate processes running on the victims' systems. In this way, the malware has continued to spread like a chain reaction in recent weeks.
Have you been infected?
To check if you have fallen victim to this attack, scan your entire system using a reliable and up-to-date antivirus. Change your Facebook password immediately (once you are sure that your system is clean).
