Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
Using a Trojanized two-factor authentication application for MacOS called MinaOTP, the Dacls malware is distributed outside traditional App Store channels. Boasting a variety of features, the latest in the malware has the ability to conduct command execution, file management, traffic proxying, and worm scanning. The bot executable resides in “Contents/Resources/Base.lproj/”, pretending to be a nib file. Previously observed certificates and private key files have also been seen with regard to this malware. Persistence is enabled through LaunchDaemons (root user driven) or LaunchAgents (logged-in user driven). The configuration file contains victim machine information. The contents are encrypted using AES with CBC. This configuration file is updated by receiving commands from the C2 server. A file plugin is also employed to read, delete, download, and search files within a directory. The Mac version, however, does not have the ability to write files. A process plugin exists for the purpose of killing, running, getting process IDs, and collecting process information. C2 connection is established via a TLS connection which then performs beaconing and encrypting the data over SSL using RC4. This variant of the Dacls RAT is associated with Lazarus, Hidden Cobra, and APT38.