MacOS beware of the new malware, Crash Stealer.

MacOS Beware of New Malware Silky Crash Stealer Disguised as Crash Report App

According to a report by the website, ITnews has mentioned the detection of malware thieves from the victim's machine, or a new Infostealer specifically focused on macOS users called Crash Stealer, with the work of a research team from Jamf, a security expert on Apple's device. The research team said that the malware is based on an impersonation application called Werkbit, which is a collaborative application on the team. On the website of the fake application, the impersonation of brands and companies that are famous for using the application is reliable, but the website is actually dependent. Registration in the last June, and importantly, this fake application does not have any interoperability. The functions on the machine are only more difficult to verify. The application was signed in the name of the developer (Apple Developer) called "Emil Grigorov" to avoid being detected by the Gatekeeper protection system on macOS. Apple later canceled the account, allowing the Gatekeeper to detect applications related to the developer account.

But in fact, the application acts as a dropper to release the real malware on the victim's machine. The installed file is a Disk Image file for the macOS operating system. A DMG with a file name called Werkbit.dmg that requires a PIN code to be opened. After the victim runs, it will lead to Fetch, a payload file from GitHub's Repo or Repository, and a Component file from other sources to be installed on the machine. The downloaded element will come in a 3-layer base-34 encoded version to confuse the protection system when trying to check for a Filesystem file inside.

This decoded Payload file is a disk image called CrashReporter.dmg inside a hidden folder called / tmp. This file is disguised as an application within macOS for reporting macOS (Crash Reporting). It has copied both the Identifier, the icon, and the Launch Agent called com.apple crashreporter.helper. If the victim opens, the fake app will trick the login code. If the victim enters, it will ultimately lead to the theft of the password inside the Key. In addition to the data in the Keychain, the Crash Stealer malware also searches for data in the Documents, Downloads, and other similar folders to steal Sensitive Data inside not only malware, but also malware.

It steals the data of the password saved within the web browser, Password Manager, and Cryptocurrency Wallet. All the data is encrypted and sent to the C2 or Command and Control server.

# Trending # lemon 8 diary # Lemon 8 Howtoo # macos # freedomhack