New Malware Framework Enables Screen Control, Browser Artifact Access, and UAC Bypass

New Malware Framework Enables Screen Control, Browser Artifact Access, and UAC Bypass

A new malware framework called TencShell has been identified by researchers at Proofpoint. This sophisticated threat leverages various techniques to evade detection and maintain persistence on compromised systems.

Key Features of TencShell:

1. Screen Control:

   • TencShell can capture screenshots from the victim's screen, allowing attackers to monitor activities remotely.

2. Browser Artifact Access:

   • The malware has the capability to access browser artifacts such as cookies and session tokens, facilitating credential theft and lateral movement.

3. UAC Bypass:

   • TencShell employs techniques to bypass User Account Control (UAC), enabling it to execute commands with elevated privileges without user consent.

Technical Details:

• File Hashes:

  • MD5: defanged
  • SHA1: defanged
  • SHA256: defanged

• IP Addresses and Domains:

  • C&C Server IP: [.]
  • Malware Distribution Domain: [.]

• Persistence Mechanisms:

  • Registry Key: `\Software\Microsoft\Windows\CurrentVersion

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.