Shulou(Shulou.com)11/24 Report--

CTOnews.com, January 7 (Xinhua)-- A derivative version of Dridex Bank malware is being spread on the macOS platform through email attachments disguised as ordinary documents, trend Technologies reported on Thursday. The report pointed out that the malicious program was originally aimed at the Windows platform, but now the hackers have changed their attack strategy to expand the influence of the regiment on the macOS platform.

Through an in-depth analysis of Dridex malicious file samples, trend Technology found that the malicious file uses Mach-O file, which is an executable file that can be run on macOS and iOS platforms. The file extensions used by these malware include .o, .dylib, and .bundle.

The Mach-O file contains a malicious document that runs automatically once the user opens it. It then overwrites all Microsoft Word files in the macOS user directory and contacts the remote server to download more files, including Windows executables (.exe) running Dridex malware.

CTOnews.com learned that these executables could not be run on macOS. However, if a user's Word file is overwritten by a malicious version, Mac users may inadvertently infect others when sharing files online.

Trend recommends users not to open attachments from unknown sources. Check who the sender is, not only by the sender's name displayed, but also by the e-mail address.

An online tool called VirusTotal can scan URL and files uploaded by people and detect if they contain malware. For example, if an email is attached to an Microsoft Word document or Mach-O file, it might be a good idea to scan it using a Web site.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.