4 ms·
> Newly discovered Mac malware uses “fileless” technique to remain stealthy ... > The malware isn’t entirely fileless. The first stage poses as a cryptocurren
by tehwebguy 7y ago
> Newly discovered Mac malware uses “fileless” technique to remain stealthy
...
> The malware isn’t entirely fileless. The first stage poses as a cryptocurrency app with the file name UnionCryptoTrader.dmg
Come on...
- pvg 7y agoIt's explained in the article and in more detail in the longer analysis it links https://objective-see.com/blog/blog_0x51.html https://objective-see.com/blog/blog_0x51.html The 'fileless' part is about getting the executable payload that does the actual malwarin' into memory without touching the filesystem.
- CodeWriter23 7y agoExcept for the part about moving a launch script into /Library/LaunchDaemons to achieve persistence.
- pvg 7y agoThat's the scaffolding, basically. A launch script in itself is not malicious and the idea is this would be less noticeable to automated or manual scans.
- moralestapia 7y ago>An executable file in itself is not malicious
- pvg 7y agoI'm not sure who you're quoting but it's not me. Easiest way to get a more detailed explanation is to read the linked technical analysis. The idea is to obfuscate and make detection harder by not-placing the actual final payload on the filesystem. Staging more-malicious things through things that look less-malicious is pretty much what makes malware mal.