The Flashback malware family is among the first widespread malware on MacOS. IAt first it went undetected for a couple of months, but then got a lot of attention in the spring of 2012 because it infected over 500,000 computers.
ReversingLabs constantly tracks emerging macOS threats as well as the old, persistent ones. Mac malware developers are actively becoming more clever, attempting to make it harder to detect the malicious nature of their software.
The ReversingLabs Titanium Platform supports configuration extraction from over 40 different RATs/Backdoors, Keyloggers, Downloaders, Ransomware and POS malware.
ReversingLabs TitaniumCore is a static analysis engine with inspection capabilities that must overcome these obfuscation attempts. To improve visibility in our products, we continuously improve unpacking by supporting new packer formats.
A step that an adversary takes during the post exploitation phase of an attack is to establish a command line interface with a computer inside the victim’s network. One recent incident demonstrates the entire intrusion set operated by FIN6, a financially motivated threat actor group.
Authenticode is a Microsoft code signing technology software publishers use to guarantee the origin and integrity of their applications. The vast majority of modern software applications are actively using it and depend on its integrity validation system.
Portable executable is probably the most prolific application format used for code distribution. It can be found on a wide variety of hardware and software platforms. That’s why it is no wonder that many systems, other than its native Windows, end up supporting it in one way or another.
Unified Extensible Firmware Interface (UEFI) is a specification that defines the interfaces between the operating system and the platform firmware. Originally developed by Intel, and now supported by an alliance of software and hardware vendors, UEFI quickly became a standard that displaced the legacy basic input/output system (BIOS).
Authenticode is a Microsoft code signing technology designed to guarantee the origin and integrity of an application. The core principle of its integrity verification system is code immutability
Get the best of RL Blog delivered to your in-box weekly to stay up to date on key trends, analysis and best practices across threat intelligence and software supply chain security.
