ESET lures operators of GMERA malware to remotely control their MAC OS workstations.
Of Marc-Etienne M.Léveillé , Senior Malware Researcher, ESET Security Community
ESET has discovered some websites distributing cryptocurrency trading applications for MAC OS affected by trojan viruses. By analyzing the malware samples, ESET discovered that it was a new campaign like the one called GMERA, which had already been analyzed by Trend Micro researchers in September 2019. As in previous cases, the malware led back to an encrypted C&C (Command & Control) server over HTTP connected remotely via terminal, connected to another C&C server using an encrypted IP address. This time, however, not only did the cybercriminals create a fake copy of the application - as well as a copy site identical to the official one - and inserted the malware into the executable, but ESET researchers identified 4 other apps verified and used by hackers as bait to distribute the trojan such as: Cointrazer, Cupatrade, Licatrade and Trezarus.
Authorized applications were copied and linked to the GMERA malware to steal browsing cookies, cryptocurrency portfolio data, and screenshots. Among the software used to attract users was the authorized Kattana App.
Researchers are still trying to pinpoint where the infected apps were advertised. However, in March 2020 the official Kattana website posted a message warning users, highlighting how victims were directly approached to be lured into downloading the infected application.
Fake sites are designed to make the download source appear to be trustworthy. On the Kattana copy site, the download button was linked to a ZIP archive, containing the executable infected by the Trojan.
In addition to analyzing the malware code, ESET researchers created a monitoring system (called Honeypot) to attract and identify hackers who controlled the GMERA malware; the researchers' goal was to reveal the goals of the cybercriminal group.
Based on the monitored activities, ESET confirms that the hackers collected information such as cookies, browsing histories, cryptocurrency wallet data and screenshots.
For more information download the complete search and follow us on the Blog ESET Italy
