Friday, November 1, 2024
HomeMalwareRunning OSX relatively safe? New Malware strains targeting all versions of MacOSX...

Running OSX relatively safe? New Malware strains targeting all versions of MacOSX clients

Published on

Malware protection

People regularly anticipate that in case you’re strolling OSX, you’re highly secure from malware. But that is turning into much less and less real, as evidenced via brand new strain of malware encountered with the aid of the Check Point research team.

Checkpoint said This new malware – dubbed OSX/Dok — influences all versions of OSX, has zero detections on VirusTotal (as of the writing of these words), is signed with a legitimate developer certificate (authenticated by means of Apple), and is the primary fundamental scale malware to target OSX users thru a coordinated email phishing campaign.

The Malware strain discovered by checkpoint researchers targeting OSX users mostly in European countries.

For instance, one phishing message turned into determined to target a person in Germany by using baiting the user with a message regarding supposed inconsistencies of their tax returns (see image, and translation, under).

- Advertisement - SIEM as a Service
 Malware strains targeting all versions of MacOSX
Source: checkpoint
Attackers get whole access to all information exchange, such as communique encrypted by means of SSL. This is done by means of redirecting victim traffic thru a malicious proxy server.

Malware Execution

The malware package consists of a.Zip archive named Dokument.Zip. It became signed on April 21th, 2017 via a “Seven Muller” and the package name is Truesteer.AppStore.

Once executed it moves to Users/Shared/ folder and then ready to execute from different locations.

Malware strains targeting all versions of MacOSX
Source: checkpoint

It will show a message the package is damaged and cannot execute.If a loginItem named “AppStore” exists, the malware will delete it, and as a substitute add itself as a loginItem, to be able to persist within the device and execute routinely each time the device reboots.

It will do the same process until payload installation successfully completed.And then it will pop up a window asking to update and try to get user’s credentials.

The victim is barred from gaining access to any windows or the usage of their system in any manner until they relent, enter the password and permit the malware to finish installing.

Then it will install additional tools like TOR(used to connect dark web) and SOCAT(multipurpose relay).

The malware then modifies the victim machine’s network settings such that every one outgoing connection will bypass thru a proxy, that is dynamically acquired from a Proxy AutoConfiguration (PAC) document sitting on a malicious server.

Then after that, it will install a bogus certificate on the victim machine to launch an MITM attack to impersonate any websites.

security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/cert.der

Malware strains targeting all versions of MacOSX
Source: checkpoint

Launch Agents

/Users/training/Library/LaunchAgents/com.apple.Safari.proxy.plist
/Users/training/Library/LaunchAgents/com.apple.Safari.proxy.pac

As an end result of all of the above actions, whilst trying to surf the net, the consumer’s web browser will first ask the attacker web page on TOR for proxy settings.

The consumer traffic is then redirected through a proxy managed via the attacker, who consists of out a Man-In-the-Middle assault and impersonates the diverse websites the user tries to surf.

The attacker is free to study the victim’s visitors and tamper with it in any way they like.When achieved, the malware will delete itself.

Checkpoint alerts users to beware of Trojans bearing gifts, especially if they ask for your root password.Sample hash – 7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c1454131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5

Also Read

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling...