Skip to main content

MaMi - first malware of MacOS in 2018 hits

Way back in 2012 we faced DNSChanger Malware which affected millions of Windows PC and in the first week of 2018 we have observed the emergence of a DNSChanger Malware for MacOS. The threat was first discovered by Patrick Wardel and has been named as MaMi.

Similar to DNSChanger, MaMi's infection vector involves various recently registered domains from where it is downloaded and subsequently installed. Post infection, MaMi forcibly changes the DNS entry and also installs a root certificate. Furthermore, it is highly persistent and reverts back to malicious DNS entries, when victims manually try to change it. 

Previously, there existed another malware which infected windows Systems "DNSUnlocker" incidentally used the same subnet, furthermore the root certificates which are installed on the victims systems too are similar.

How does MaMi function?
Installs a local certificate - Installation of root certificate allows the threat to perform an effective MITM attack, which may range from stealing logon credentials to ad insertions.
Set up custom DNS settings - The DNS IP added by MaMi are under the control of the criminals and they may resolve every request by the victims and redirect them to malicious domains or Advertisements controlled by the criminals.
Take screenshots - of the desktop
Run AppleScripts - Ability to execute script allows the Trojan to execute tasks as per the defined payload
Get OS launch persistence - At system startup load itself
Download and upload files - allows to steal sensitive files and in all probability download additional modules / scripts


Indicators of Compromise:

Victims may observe the existence of the below mentioned DNS Entries:

82.163.143.135
82.163.142.137
Domains Registered by the Threat Actor:

angein.ingfo
infolilovakia.info
inforegardens.info
infodefinitial.info
infohumption.info


How to prevent MaMi:
As was the case with DNS Changer, it is difficult to prevent MaMi from taking over an unsuspecting victim. By monitoring and blocking network machines from attempting to access the above mentioned malicious domains is one of the prevention recommendations.  Furthermore, due to the DNS Changer bot, most of the AVs have been protecting the DNS entries of the systems; hence it would be interesting to observe MaMi and the mutations it may undergo in the future.

Install and update anti-virus/malware software.

Keep your OS updated
Do not access any unsolicited website
Keep a backup of your data regularly
Do not use open Wi-Fi mostly at public places



Comments

Popular posts from this blog

Cloud Computing powering India’s priority of ‘Digital-first country’

By: Sunil Mahale, India MD and VP, Nutanix
Digital transformation has been recognized as being vital to the growth of our nation. This transformation has enjoyed the unanimous approval and contribution from all stake holders including enterprises, MSMEs, government bodies and citizens. But this level of adoption in a country with a population of over a billion people would need a robust technology base that is capable to collecting and distributing vital data seamlessly.
Digital India envisions creating high speed digital highways, that will impact commerce and create a digital footprint for every individual. Technologies based on mobility, analytics, Internet of things and most importantly, cloud technologies are the building blocks for the digital India missionThere is a growing need to manage huge volumes of data, and making them readily available to public through digital cloud services. Cloud has a pivotal role in enabling this change.
While Data centers have become crucial to th…

RevStart launches its RevItUp Incubation Programme

Underlining its vision of creating a nurturing ecosystem for start-ups to grow in, RevStart, a co-working and incubation centre, has announced the launch of its RevItUp Incubation Programme. The 12-week long programme will be held at RevStart Incubation Centre in Noida from July 1, 2018 onwards. As part of the programme, RevStart will select five high potential start-ups from the ed-tech sector, AI, Consumer Internet, Sustainability, as well as for-profit social impact companies to assist them with developing their business, along with connecting them to global mentors across industries and sectors. In addition, start-ups selected for the programme will receive INR 5 lakh to Rs. 25 lakhs worth of cash and benefits, while RevStart will get an equity stake in the ventures.
The RevItUp Incubation Programme has been created to enhance the founding team’s industry, product, and company building knowledge and capabilities through a world-class curriculum. The programme will focus on tailor…

Insurtech startup Kruzr raises $1.3 Million from Saama Capital and Better Capital

InsurTech startup Kruzr has raised 1.3 Million USD (Rs. 9.5 Cr) for its seed round led by Saama Capital with participation from Better Capital. Kruzr is a preventive motor insurance technology which helps insurance companies personalize policy premiums & improve their risk model by delivering an engaging preventative driving assistant to their customers. Kruzr is founded by Pallav Singh, Ayan, and Jasmeet Singh Sethi.

Kruzr blends the power of voice technology and artificial intelligence in its personal driving assistant that helps drivers minimize mobile distractions, drowsy driving, speeding and external risks like weather and accident-prone zones. In pilots with insurers, Kruzr managed to cut down distracted driving by 80%. Kruzr is working with motor insurance companies in Europe, UK and India to bring its technology to their customers to prevent accidents & improve claims.

“Road accidents cause over 1.3 million deaths globally every year, and motor insurance companies los…