For example, OSX.EvilQuest uses a malicious package - after mounting the. mpkg) are another common file type abused by malware as they allow malware developers to define preinstall and postinstall scripts that automatically run through the installation process. Apple Disk Images (.dmg) are favored because they’re automatically mounted on execution both OSX.EvilQuest (Figure 3) and OSX.Shlayer malware typically use this file type.Figure 2 offers an overview of macOS malware file types.Įven though most malware are compiled binaries, many non-binary file types are commonly encountered while analyzing macOS malware each has its own advantages and disadvantages for the adversaries that use them. File-type identification also helps in establishing the tools required in the analysis. Malware developers often try to hide or mask file types in an attempt to trick users into executing them. File Type Classification for macOS Threats Threats that target macOS systems have the same goals as those targeting any other operating systems they range from spying and reconnaissance to cryptocurrency mining, file encryption, remote access, and adware-related hijack and injection. MacOS malware research starts with the fundamentals, such as classifying macOS malware by file type continues with the capabilities, intended targets and general behavior of malware and ends with obstacles researchers encounter when analyzing macOS malware. The deep understanding and knowledge they gain is used both to create new features for structural parsing that augments our machine learning detection capabilities and to improve the proficiency of our behavior-based protection. This blog addresses some of the challenges and requirements our researchers must meet when analyzing macOS threats. The fallacies that macOS cannot be harmed by threats or is targeted by less-sophisticated malware still linger. CrowdStrike researchers constantly hunt, analyze and gain understanding of any macOS artifact that looks even remotely suspicious to improve CrowdStrike’s automated machine learning and behavior-based protection capabilities. Improving the CrowdStrike Falcon® platform’s ability to detect macOS threats is a continuous process. Named OSAMiner, the malware has been distributed in the wild since at least 2015 disguised in pirated (cracked) games and software such as League of Legends and Microsoft Office for Mac, security firm SentinelOne said in a report published this week.įor more than five years, macOS users have been the targets of a sneaky malware operation that used a clever trick to avoid detection and hijacked the hardware resources of infected users to mine cryptocurrency behind their was the most prevalent macOS ransomware family in 2021, accounting for 98% of ransomware in the researchers’ analysis, while OSX.Flashback accounted for 31% of macOS backdoor threats and OSX.Lador accounted for 47% of macOS trojans. Used runonly applescripts to avoid detection software# “OSAMiner has been active for a long time and has evolved in recent months,” a SentinelOne spokesperson told ZDNet in an email interview on Monday. “From what data we have it appears to be mostly targeted at Chineses/Asia-Pacific communities,” the spokesperson added. Nested run-only AppleScripts, for the win!īut the cryptominer did not go entirely unnoticed. SentinelOne said that two Chinese security firms spotted and analyzed older versions of the OSAMiner in August and September 2018, respectively.īut their reports only scratched the surface of what OSAMiner was capable of, SentinelOne macOS malware researcher Phil Stokes said yesterday. The primary reason was that security researchers weren’t able to retrieve the malware’s entire code at the time, which used nested run-only AppleScript files to retrieve its malicious code across different stages.Īs users installed the pirated software, the boobytrapped installers would download and run a run-only AppleScript, which would download and run a second run-only AppleScript, and then another final third run-only AppleScript. Since “run-only” AppleScript come in a compiled state where the source code isn’t human-readable, this made analysis harder for security researchers.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |