Singapore Warns of Malware Spreading Through Hijacked WhatsApp Accounts

Singapore's SingCERT has received multiple reports of malware sent through compromised WhatsApp accounts, the Cyber Security Agency said in an advisory on 28 October. The files pose as business documents and arrive from people the victim knows. Anyone who opened one found it had gone out to their own contacts.

Malaysians were reporting malware files sent over WhatsApp in late September, and CSA's indicators come from Malaysia's MyCERT.

What it can do

Depending on the malware, attackers can take over the device, steal credentials and watch online banking. CSA doesn't name a malware family.

Signs of infection

MyCERT's host indicators:

• a C:\kouren or C:\cool folder on the system drive;
• an msiexec process installing UEMSAgent.msi with SERVER_ROOT_CRT= and DS_ROOT_CRT= parameters;
• certificates with CN=ManageEngineCA in the trusted root store;
• outbound TCP connections to port 8383;
• a ManageEngine UEMS_Agent install on a machine that has never run endpoint-management tools.

What CSA advises

1. Don't open unexpected attachments, even from people you know, and be wary of .exe, .iso and .zip files.
2. Check with the sender by phone or another channel before opening.
3. If you've opened one, disconnect the device, scan it, and warn your contacts not to open files from your account.
4. In WhatsApp, review linked devices, log out of any you don't recognise and turn on two-step verification.
5. Report unauthorised bank transactions to the bank and the police straight away.