New macOS Threat Served from Cryptocurrency Trading Platform

guest · Dec 4, 2019

New macOS Threat Served from Cryptocurrency Trading Platform
...is believed to have been developed by the notorious North Korean hacking group Lazarus
December 4, 2019
https://www.bleepingcomputer.com/ne...-served-from-cryptocurrency-trading-platform/

Security researchers have encountered a new macOS malware sample believed to be the work of the North Korean group of hackers known as Lazarus.
The threat has a very low detection rate and comes with capabilities that allow it to retrieve a payload from a remote location and run it in memory, making the forensic analysis more difficult.
macOS threat on trading platform
Malware researcher Dinesh Devadoss on Tuesday provided a hash for a new macOS malware sample that could load a mach-O executable file from memory and execute it.
Checking the sample on VirusTotal shows that its detection is almost inexistent.

In a detailed analysis published today, the researcher notes that the malware has a 'postinstall' script that installs the 'vip.unioncrypto.plist' launch daemon for persistence.
The lack of a valid certificate and the missing payload could suggest that the malware was discovered before the attacker was able to prepare all the details of the operation.
Click to expand...

Objective-See: Lazarus Group Goes 'Fileless' - an implant w/ remote download & in-memory execution

Daveski17 · Dec 4, 2019

ProTruckDriver · Dec 4, 2019

Daveski17 said: ↑

Click to expand...

Mac is not as bad as Microsoft though, but they will be getting there soon as time goes on.

Daveski17 · Dec 4, 2019

ProTruckDriver said: ↑

Mac is not as bad as Microsoft though, but they will be getting there soon as time goes on.
Click to expand...

I think Mac are more on the ball, plus I'm convinced Unix system architecture is more resilient. Anything's better than Windows.

ProTruckDriver · Dec 4, 2019

Daveski17 said: ↑

Anything's better than Windows.
Click to expand...

Agree!

Daveski17 · Dec 4, 2019

guest · Jul 17, 2020

GMERA malware targeting mac crypto users detected
July 17, 2020
https://www.cryptopolitan.com/gmera-malware-attack-mac-crypto-users-detect/

Researchers have discovered ‘GMERA malware’ a trojan that targets crypto traders using Mac.

The malware infects targets through websites that imitate legitimate websites with a similar domain and user interface to target unsuspecting users. The malware was detected by researchers at cybersecurity company ESET who revealed that the GMERA malware can steal data through “browser cookies, crypto wallets and screen captures.”
GMERA malware
GMERA operators duplicate legit websites to promote the trojan. These websites are extremely similar and may look legit to an untrained eye

ESET researchers revealed that the orchestrators behind the GMERA malware steal data store in targets’ crypto wallets, browser information such as history and cookie data, and screen captures.
The attackers ‘hunt’ by directly contacting the victim and manipulate them into downloading the malicious file.
Click to expand...

ESET: Mac cryptocurrency trading application rebranded, bundled with malware

ESET researchers lure GMERA malware operators to remotely control their Mac honeypots
Click to expand...

Log in or Sign up

New macOS Threat Served from Cryptocurrency Trading Platform

guest Guest

Daveski17 Registered Member

ProTruckDriver Registered Member

Daveski17 Registered Member

ProTruckDriver Registered Member

Daveski17 Registered Member

guest Guest

Log in or Sign up

New macOS Threat Served from Cryptocurrency Trading Platform

guest Guest

Daveski17 Registered Member

ProTruckDriver Registered Member

Daveski17 Registered Member

ProTruckDriver Registered Member

Daveski17 Registered Member

guest Guest

Useful Searches