They note that malware like that contained in the spoofed Stockfolio app may infect thousands of users before the threat becomes publicly known. Is Apple’s response enough?įortunately, the fake Stockfolio app’s malware is unable to execute “ due to the fact that Apple has since revoked the code signature used to sign these samples.” Nonetheless, critics assert that eliminating the threat after the fact is less than ideal. Unfortunately, getting rid of this reverse shell code is fairly difficult, as the second malware version contains a property list file that recreates it every 10,000 seconds. Once decrypted, the file produces a simple reverse shell that enables hackers to remotely execute shell commands on the infected computer. However, it also decrypts the server response file mentioned above. The second malware version acts in much the same way as the first, though it only employs a single shell script to copy files. In return, the server sends a response in another hidden file (for later use). According to Trend Micro researchers, once the data is collected, it is then encrypted in an invisible file and sent to the malware developer’s server. The script operates within the Resources directory, collecting the host computer’s username, IP address, app files, document files, desktop files, and operating system files. However, this execution will also set in motion a data collection script.
Users who execute the file will see the actual Stockfolio app interface.
#STOCKFOLIO SCAM ZIP FILE#
The zip file also includes the legitimate Stockfolio app and the malware developer’s digital certificate.
The original malware version is a zip file containing Stockfoli.app files (notice the missing ‘o’ in the filename?) along with an invisible encrypted. The second variant, though it only uses one shell script, also contains a “persistence mechanism” and is far more difficult to get rid of. The cybersecurity firm reports that a spoof of the popular Stockfolio trading app contains a malware file named .Īccording to the report, there are actually two variants of the malware, the first of which uses a pair of shell scripts to collect and encode user data.
#STOCKFOLIO SCAM SOFTWARE#
Trend Micro has revealed that malware software has been disguised as a legitimate crypto trading app in order to steal user information.
0 kommentar(er)
