Cybercriminals try to capitalize on their victims in every possible way by distributing various types of malware designed for different platforms.
In recent months, we have written private reports on a wide range of topics, such as new cross-platform ransomware, macOS stealers and malware distribution campaigns.
In this article, we share excerpts from our reports on the FakeSG campaign, the Akira ransomware and the AMOS stealer.
Clicking the notification downloads a malicious file to the device.
Over the course of time, the attackers have changed the download URL to stay undetected longer.
The download is a JS file that contains obfuscated code.
Finally, it displays a prompt to update the browser and starts automatically downloading another script.
Part of the 7z file is a malicious configuration file containing the address of the C2. C2 address.
Akira is a relatively new ransomware variant, first detected in this past April and written in C++, that can run in Windows and Linux environments.
Despite the malware being relatively new, the attackers behind Akira are quite busy with over 60 confirmed infected organizations worldwide.
In many ways, Akira is no different from other ransomware families: shadow copies are deleted; logical drives are encrypted, and certain file types and directories are skipped; there is a leak/communication site on TOR; and so on.
Akira's communication site is something different.
Certain famous stealers, such as Redline and Raccoon, have been around for years.
In the beginning of the year, we saw a number of new stealers appearing for macOS: XLoader, MacStealer, Atomic MacOS aka AMOS and others.
The initial version, written in Go, had typical stealer features, such as stealing passwords, files, browser data and so on.
The new version changed a few things, most notably, the programming language.
Similarly to the Redline and Rhadamantys campaigns, popular software sites get cloned, and users are lured into downloading the malware.
The downloaded file is a DMG image that contains instructions on how to install the malware as can be seen in the image below.
The first thing the malware does is retrieve the user name and check if the password is blank or no password is required.
If the password is required and the user is not logged in, the malware creates a popup using osascript, asking to enter the password.
This Cyber News was published on securelist.com. Publication date: Wed, 13 Dec 2023 10:13:04 +0000