Windows App Runs on Mac, Downloads Info Stealer and Adware

guest · Feb 11, 2019

Windows App Runs on Mac, Downloads Info Stealer and Adware
February 11, 2019
https://blog.trendmicro.com/trendla...uns-on-mac-downloads-info-stealer-and-adware/

However, we found EXE files in the wild delivering a malicious payload that overrides Mac’s built-in protection mechanisms such as Gatekeeper. This routine evades Gatekeeper because EXE is not checked by this software, bypassing the code signature check and verification since the technology only checks native Mac files.

Inspecting the installer contents, we found the unusual presence of the .EXE file bundled inside the app, verified to be a Windows executable responsible for the malicious payload.
When the installer is executed, the main file also launched the executable as it is enabled by the mono framework included in the bundle. This framework allows the execution of Microsoft .NET applications across platforms such as OSX.

We think that the cybercriminals are still studying the development and opportunities from this malware bundled in apps and available in torrent sites, and therefore we will continue investigating how cybercriminals can use this information and routine.
Click to expand...

guest · Apr 24, 2019

Apple Updates XProtect to Block 'Windows' Malware on Macs
April 24, 2019
https://www.bleepingcomputer.com/ne...es-xprotect-to-block-windows-malware-on-macs/

Apple's XProtect security software has been silently updated to include signatures that detect Windows PE files and Windows executables that can run on Macs by utilizing the Mono .NET framework.

According to mac security expert Patrick Wardle, two new signatures were released on April 19th, 2019 that when used together can detect adware bundles that contain Windows executables that can run on macOS.
These two new signatures are called "PE", which detects Windows PE files, and "MACOS.d1e06b8", which is used to detected a specially crafted Windows executable that can run on Macs.
Targeting Mac adware bundles
In February, we reported that malware was spotted that utilize a Mac installer to execute Windows executables using the Mono C# framework.
As languages like C# become cross-platform, being able to detect Windows PE files are important to protect users from malware that can now be easily ported to Macs utilizing a framework like Mono.
Click to expand...

Log in or Sign up

Windows App Runs on Mac, Downloads Info Stealer and Adware

guest Guest

guest Guest

Log in or Sign up

Windows App Runs on Mac, Downloads Info Stealer and Adware

guest Guest

guest Guest

Useful Searches