The post New Chinese Malware “CopperStealer” Thieving Credentials Saved by Browsers appeared first on CISO MAG | Cyber Security Magazine.
]]>Possible Links to Chinese Hackers
According to an investigation from ProofPoint, CopperStealer operates similar to SilentFade malware, which is linked to Chinese hackers that targeted Facebook’s ad platform between late 2018 and February 2019. “Proofpoint believes CopperStealer to be a previously undocumented family within the same class of malware as SilentFade, StressPaint, FacebookRobot, and Scranos,” Proofpoint said.
How CopperStealer Spreads
It was found that threat actors behind the CopperStealer malware campaign are leveraging compromised accounts to run malicious ads and deliver additional malware on targeted sources.
The researchers identified certain suspicious websites, advertised as KeyGen, Crack, keygenninja, piratewares, startcrack, and crackheap, which hosted CopperStealer malware samples. All these sites have advertised themselves as software crack services to evade licensing restrictions and ultimately provide Potentially Unwanted Programs/Applications (PUP/PUA) or run malicious exploits to install additional malware payloads.
Proofpoint’s researchers stated that CopperStealer malware can find and send saved browser passwords. The multiple browsers searched by malware operators to get Facebook saved credentials are:
- Chrome
- Edge
- Yandex
- Opera
- Firefox
Once downloaded, CopperStealer sends the exfiltrated data to the C2 server via a POST request to several targeted URIs. The exfiltrated data is then stored in the info key and is encrypted in the C2 Traffic encryption section.
“In addition to the saved browser passwords, the malware uses stored cookies to retrieve a User Access Token from Facebook. Once the User Access Token is gathered, the malware requests several API endpoints for Facebook and Instagram to gather additional context, including a list of friends, any advertisement accounts configured for the user, and a list of pages the user has been granted access to,” Proofpoint explained.
Malware Analysis
The CopperStealer malware used various basic anti-analysis techniques to avoid running within researcher systems. These include:
- IsDebuggerPresent() check
- GetSystemDefaultLCID() == 0x804 (Chinese (Simplified, PRC) zh-CN) check
- Window/class enumeration looking for common analysis tools:
- TCPViewClass
- TStdHttpAnalyzerForm
- HTTP Debugger
- Telerik Fiddler
- ASExplorer
- Charles
- Burp Suite
- Device enumeration looking for indicators of virtualization
- VMware
- virtual
- vbox
“While CopperStealer isn’t the most nefarious credential/account stealer in existence, it goes to show that even with basic capabilities, the overall impact can be large. Findings from this investigation point towards CopperStealer being another piece of this ever-changing ecosystem. CopperStealer’s active development and use of DGA based C2 servers demonstrate operational maturity as well as redundancy,” Proofpoint added.
The post New Chinese Malware “CopperStealer” Thieving Credentials Saved by Browsers appeared first on CISO MAG | Cyber Security Magazine.
]]>The post 30,000 Macs Affected by “Silver Sparrow” Mystery Malware appeared first on CISO MAG | Cyber Security Magazine.
]]>Analyzing the Silver Sparrow Malware
Red Canary’s blog post offers an in-depth analysis of how the malware was discovered, its targets, operations, and how it affects Apple’s latest M1 chip. For those who want facts and figures, the Silver Sparrow malware is currently the second known malware targeting the Apple M1 silicon chip. The first one was incidentally discovered a week ago by security researcher Patrick Wardle from Objective-See.
As per Red Canary, the Silver Sparrow malware has two versions:
- Version 1 IOCs
File name: updater.pkg (installer package for v1)
MD5: 30c9bc7d40454e501c358f77449071aa
- Version 2 IOCs
File name: update.pkg (installer package for v2)
MD5: fdd6fb2b1dfe07b0e57d4cbfef9c8149
As shown in the above image, one version is a binary in mach-object format compiled for Intel x86_64 processors and the other version is a Mach-O binary for the M1 chip. The researchers believe that these are “bystander binaries” as they only display messages like “Hello World!” and “You did it!” when executed. As precautionary measures, Apple has revoked the licenses of both the binaries effective immediately.
Related News:
TeamTNT Spreads Malware with New Detection Evasion Tool “Libprocesshider”
Silver Sparrow uses Apple’s system.run command for execution and is thus difficult to detect. Researchers found that every hour the malware contacts the command-and-control center (C2) for further actions, however, none have been observed until now keeping the malware in stealth mode. Another interesting mechanism that the Silver Sparrow malware contains is its self-destruct mode. It has a file check that causes removal of all persistence mechanisms and scripts on execution leaving behind no trail of the attack vectors. Researchers say that the presence of such a sophisticated mechanism for this malware is also a “mystery,” because it means that the attackers were getting ready for a stealthy persistent attack rather than a simple intrude, spread, and exfiltrate kind of attack.
Thankfully, there is still no known indication of any damages through this malware, but the fact that Red Canary’s researchers found these strains of malware on Macs in the wild is worrisome. For the complete list of IOCs of the Silver Sparrow malware, click here.
Related News:
Researcher Finds New Android Malware Spreading Via WhatsApp Messages
The post 30,000 Macs Affected by “Silver Sparrow” Mystery Malware appeared first on CISO MAG | Cyber Security Magazine.
]]>The post MicroWorld and CERT-In Collaborate to Enhance Overall Cybersecurity in India appeared first on CISO MAG | Cyber Security Magazine.
]]>As per the MoU, MicroWorld will facilitate cooperation for detecting latest cyberthreats like malware/botnet attacks. CERT-In will also provide a platform on its “Cyber Swachhta Kendra” (Botnet Cleaning and Malware Analysis Centre) website for users to access MicroWorld’s eScan antivirus bot removal toolkit, which enables users to scan their Windows-based systems and prevent viruses like adware, spyware, and other forms of malware. The Cyber Swachhta Kendra is a part of the Government of India’s Digital India initiative operated by CERT-In.
Sanjay Bahl, Director General, CERT-In said, “As the complexity, frequency, and sophistication of malware continues to increase impacting the end user digital devices, there is a need for appropriate tools in the hands of citizens to safeguard themselves. The eScan tool from MicroWorld will help towards the vision of making India cyber swachh and build technical capacities within the country while safeguarding citizens from malware threats.”
Govind Rammurthy, Managing Director and CEO of MicroWorld Technologies, said, “IT security is a matter of grave concern in these trying times. eScan Antivirus Toolkit – will be available through CERT-In’s Cyber Swachhta Kendra platform for users across the country to utilize for free and stay secure. We aim to secure the country’s cyberspace with our futuristic and proactive technology with the aim of defending against any malignant advances that would arise from the digital universe.”
The post MicroWorld and CERT-In Collaborate to Enhance Overall Cybersecurity in India appeared first on CISO MAG | Cyber Security Magazine.
]]>