March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Multi-stage APT attack drops Cobalt Strike using Malleable C2 feature
June 19, 2020
Rewterz Threat Alert – Raddex Malware Targeting Arabic-speakers, Linked to Golden RAT
June 19, 2020
Rewterz Threat Alert – Multi-stage APT attack drops Cobalt Strike using Malleable C2 feature
June 19, 2020
Rewterz Threat Alert – Raddex Malware Targeting Arabic-speakers, Linked to Golden RAT
June 19, 2020
Severity
Medium
Analysis Summary
Intego has discovered new Mac malware in the wild, actively spreading through malicious results in Google searches. While searching Google for the exact titles of YouTube videos, Intego’s research team encountered Google search results that, when clicked, pass through multiple redirection sites and end up on a page that claims the visitor’s Flash Player is out of date, and displays deceptive warnings and fake dialog boxes to entice the victim to download a supposed Flash Player updater—which is, in fact, a Trojan horse.
The new malware tricks victims into bypassing Apple’s built-in macOS security protections, and it uses sneaky tactics in an effort to evade antivirus detection. This newly updated Shlayer malware is delivered as a Trojan horse application on a .dmg disk image, masquerading as an Adobe Flash Player installer.
After the deceptive Flash Player installer is downloaded and opened on a victim’s Mac, the disk image will mount and display instructions on how to install it. The instructions tell users to first “right-click” on flashInstaller and select Open, and then to click Open in the resulting dialog box. If a user follows the instructions, the “installer app” launches. While the installer has a Flash Player icon and looks like a normal Mac app, it’s actually a bash shell script that will briefly open and run itself in the Terminal app. As the script runs, it extracts a self-embedded, password-protected .zip archive file, which contains a traditional (though malicious) Mac .app bundle. After installing the Mac app into a hidden temporary folder, it launches the Mac app and quits the Terminal. All this takes place within a split second. Once the Mac app launches, it downloads a legitimate, Adobe-signed Flash Player installer, so that it can appear to be genuine—but the hidden Mac app is designed to also have the capability to download any other Mac malware or adware package as instructed by the C2.
Impact
- Security Bypass
- Detection Evasion
- Unauthorized Access
Indicators of Compromise
Domain Name
- installerapi[.]com
- display[.]monster
- installvibes[.]com
- flashdownloader[.]pro
- yougotupdated[.]com
- defenderbrowser[.]com
- flashdownloader[.]pro
- defenderbrowser[.]com
- installvibes[.]com
MD5
- 47ac2e9bceeb6c8de69e28e0edb284d3
- 4c50d40bbdc9335fa6f36cd70695f53f
- 979efa6aeb8a63edf8bd1d8f21f61c0b
- 2d8316e85c6e7c3c117cebf273ef5143
- 7b80dcbbfd5024cd2e4d895bb3ef63de
- c87784c532b5fd113354bb83d80dd5ec
SHA-256
- 86561207a7ebeb29771666bdc6469d81f9fc9f57eedda4f813ca3047b8162cfb
- 907c31b2da15aa14d06c6e828eef6ca627bd1af88655314548f747e5ed2f5697
- 05b9383b6af36e6bf232248bf9ff44e9120afcf76e50ac8aa28f09b3307f4186
- 2c2c611965f7b9c8e3524a77da9b2ebedf1b7705e6276140cffe2c848bff9113
- 97ef25ad5ffaf69a74f8678665179b917007c51b5b69d968ffd9edbfdf986ba0
- d49ee2850277170d6dc7ef5f218b0697683ffd7cc66bd1a55867c4d4de2ab2fb
SHA1
- 17413f07c93296d9b728e4457779638f2bfdeac2
- 2a4148b3c68dfebd022c9da486d950b3f10afe6e
- c4708467b25176c02b16fb1d3eead8be0adc2d05
- fda26e03ffa513f7ef99fb158194bdd3b55e2bc3
- de3b9697ef373db6fb93c0424844ae35f0a7131b
- 291e7ae52dfc17c8d73ab36bd615c1dacd9f2851
Remediation
- Block the threat indicators at respective controls.
- Don’t click on suspicious links, especially the surprise pop-up windows.
- Don’t install Flash player, especially from a site that’s offering a pirated livestream. (Adobe will end support for Flash Player this year).