#Wemo control mac zip file#
#Wemo control mac code#
#Wemo control mac password#

Hxxp//maccracked23site/uploadLogīy looking at the VirusTotal graph, the Uptycs research team concluded that more MacStealer samples have been spreading recently. You can navigate to the toolkit data section of the detection alert, then click a name to learn about its behavior (figure 14).įigure 14: Uptycs event detection for MacStealerĩb17aee4c8a5c6e069fbb123578410c0a7f44b438a4c988be2b65ab4296cff5eĦa4f8b65a568a779801b72bce215036bea298e2c08ec54906bb3ebbe5c16c712 Uptycs EDR-armed with YARA process scanning, advanced detections, and the ability to correlate process file, process, and socket events-successfully detects the many tactics, techniques, and procedures (TTPs) carried out by MacStealer.Īdditionally, Uptycs EDR contextual detection provides additional details about the detected malware.

#Wemo control mac zip file#

Once it has sent the compiled ZIP file to the C2, the latter shares the file with a threat actor's personal Telegram bot (figure 12).įigure 12: Sending ZIP file to private Telegram bot įigure 11: Sending basic information to the Telegram public channel Simultaneously, the MacStealer transmits selected information to the listed Telegram channels. It deletes the data and ZIP file from the victim’s system during a subsequent mop-up operation.įigure 8: Stealer collecting data The stealer then ZIPs up the data and sends it to C2 via a POST request using a Python User-Agent request (figures 8 and 9). It stores it in the following system directory. Once the user enters their login credentials, the stealer gathers data as described in the MacStealer's features section. Osascript -e display dialog 'MacOS wants to access the System Preferences,' with title 'System Preferences' with icon caution default answer '' with hidden answer

#Wemo control mac password#

After a user executes the file, it opens a fake password prompt to gather passwords using the following command line.

#Wemo control mac code#

The Mach-O file is compiled from Python code (figures 5 and 6). Shown in figure 4, the Mach-O file is not digitally signed.

Extract Ke圜hain database (base64 encoded)įigure 2: Threat actor selling MacStealer for $100/build Malware Operationįigure 3 shows the MacStealer operational behavior.įigure 3: MacStealer malware operation Technical Analysis.

Collect the passwords, cookies, and credit card data from Firefox, Google Chrome, and Brave browsers.

The stealer exhibits the following capabilities:

It affects Catalina and subsequent macOS versions riding on Intel M1 and M2 CPUs.įigure 1:Threat actor advertisement on the dark web The stealer can extract documents, cookies from a victim's browser, and login information. The threat actor who is distributing MacStealer was discovered by the Uptycs threat intelligence team during our dark web hunting.

Attackers are increasingly turning to it, particularly for stealer command and control (C2).Īnd now the Uptycs threat research team has discovered a macOS stealer that also controls its operations over Telegram. Uptycs has already identified three Windows-based malware families that use Telegram this year, including Titan Stealer, Parallax RAT, and HookSpoofer. Research by Shilpesh Trivedi and Pratik Jeware