{"id":16177,"date":"2020-07-16T16:25:55","date_gmt":"2020-07-16T08:25:55","guid":{"rendered":"https:\/\/version-2.com\/?p=16177"},"modified":"2020-11-04T13:23:11","modified_gmt":"2020-11-04T05:23:11","slug":"trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/","title":{"rendered":"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

BRATISLAVA, MONTREAL\u00a0<\/strong>\u2013 ESET researchers have recently discovered websites distributing trojanized cryptocurrency trading applications for Mac computers. These were legitimate apps wrapped with GMERA malware, whose operators used them to steal information, such as browser cookies, cryptocurrency wallets and screen captures. In this campaign, the legitimate Kattana trading application was rebranded \u2013 including setting up copycat websites \u2013 and the malware was bundled into its installer. ESET researchers saw four names used for the trojanized app in this campaign: Cointrazer, Cupatrade, Licatrade and Trezarus.<\/p>\n

<\/p>\n

<\/p>\n

\u201cAs in previous campaigns, the malware reports to a Command & Control server over HTTP and connects remote terminal sessions to another C&C server using a hardcoded IP address,\u201d says ESET researcher Marc-Etienne M.L\u00e9veill\u00e9, who led the investigation into GMERA.<\/p>\n

<\/p>\n

<\/p>\n

ESET researchers have not yet been able to find exactly where these trojanized applications are promoted. However, in March 2020, the legitimate Kattana site posted a warning suggesting that victims are approached individually to lure them to download a trojanized app, thus pointing to social engineering. Copycat websites are set up to make the bogus application download look legitimate. The download button on the bogus sites is a link to a ZIP archive containing the trojanized application bundle.<\/p>\n

<\/p>\n

<\/p>\n

In addition to the analysis of the malware code, ESET researchers have also set up honeypots (research computers) and lured GMERA malware operators to remotely control the honeypots. The researchers\u2019 aim was to reveal the motivations behind this group of criminals. \u201cBased on the activity we have witnessed, we can confirm that the attackers have been collecting browser information, such as cookies and browsing history, cryptocurrency wallets and screen captures,\u201d concludes M.L\u00e9veill\u00e9.<\/p>\n

<\/p>\n

<\/p>\n

For more technical details on the latest GMERA malicious campaign, read the full blogpost, \u201cMac cryptocurrency trading application rebranded, bundled with malware<\/a>,\u201d on WeLiveSecurity. Make sure to follow\u00a0ESET Research on Twitter<\/a>\u00a0for the latest news from ESET Research.<\/p>\n

<\/p>\n

<\/p>\n

\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

About Version 2 Digital<\/h3>

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n

\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

About ESET<\/strong>
For 30 years, ESET\u00ae has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET\u2019s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24\/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single \u201cin-the-wild\u201d malware without interruption since 2003.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

BRATISLAVA, MONTREAL\u00a0\u2013 ESET researchers have recently d […]<\/p>","protected":false},"author":143524195,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_wpcom_ai_launchpad_first_post":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[40,61,99],"tags":[41,98],"class_list":["post-16177","post","type-post","status-publish","format-standard","hentry","category-eset","category-press-release","category-year2020","tag-eset","tag-98"],"acf":[],"yoast_head":"\nTrojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/version-2.com\/en\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers - Version 2\" \/>\n<meta property=\"og:description\" content=\"BRATISLAVA, MONTREAL\u00a0\u2013 ESET researchers have recently d […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/version-2.com\/en\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-16T08:25:55+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-11-04T05:23:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/version-2.com\/wp-content\/uploads\/2020\/04\/blog-v2-logo.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"250\" \/>\n\t<meta property=\"og:image:height\" content=\"70\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"version2hk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"version2hk\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/07\\\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/07\\\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\\\/\"},\"author\":{\"name\":\"version2hk\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\"},\"headline\":\"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers\",\"datePublished\":\"2020-07-16T08:25:55+00:00\",\"dateModified\":\"2020-11-04T05:23:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/07\\\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\\\/\"},\"wordCount\":330,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"keywords\":[\"ESET\",\"2020\"],\"articleSection\":[\"ESET\",\"Press Release\",\"2020\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/07\\\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\\\/\",\"url\":\"https:\\\/\\\/version-2.com\\\/2020\\\/07\\\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\\\/\",\"name\":\"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"datePublished\":\"2020-07-16T08:25:55+00:00\",\"dateModified\":\"2020-11-04T05:23:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/07\\\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/version-2.com\\\/2020\\\/07\\\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/07\\\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\",\"name\":\"version2hk\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"caption\":\"version2hk\"},\"sameAs\":[\"http:\\\/\\\/version2xfortcom.wordpress.com\"],\"url\":\"https:\\\/\\\/version-2.com\\\/en\\\/author\\\/version2hk\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/version-2.com\/en\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/","og_locale":"en_US","og_type":"article","og_title":"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers - Version 2","og_description":"BRATISLAVA, MONTREAL\u00a0\u2013 ESET researchers have recently d […]","og_url":"https:\/\/version-2.com\/en\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/","og_site_name":"Version 2","article_published_time":"2020-07-16T08:25:55+00:00","article_modified_time":"2020-11-04T05:23:11+00:00","og_image":[{"width":250,"height":70,"url":"https:\/\/version-2.com\/wp-content\/uploads\/2020\/04\/blog-v2-logo.jpg","type":"image\/jpeg"}],"author":"version2hk","twitter_card":"summary_large_image","twitter_misc":{"Written by":"version2hk","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/version-2.com\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/#article","isPartOf":{"@id":"https:\/\/version-2.com\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/"},"author":{"name":"version2hk","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db"},"headline":"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers","datePublished":"2020-07-16T08:25:55+00:00","dateModified":"2020-11-04T05:23:11+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/"},"wordCount":330,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"keywords":["ESET","2020"],"articleSection":["ESET","Press Release","2020"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/","url":"https:\/\/version-2.com\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/","name":"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"datePublished":"2020-07-16T08:25:55+00:00","dateModified":"2020-11-04T05:23:11+00:00","breadcrumb":{"@id":"https:\/\/version-2.com\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/version-2.com\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/version-2.com\/2020\/07\/trojanized-mac-cryptocurrency-app-collects-wallets-and-screenshots-eset-research-discovers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/zh\/"},{"@type":"ListItem","position":2,"name":"Trojanized Mac cryptocurrency app collects wallets and screenshots, ESET Research discovers"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db","name":"version2hk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","caption":"version2hk"},"sameAs":["http:\/\/version2xfortcom.wordpress.com"],"url":"https:\/\/version-2.com\/en\/author\/version2hk\/"}]}},"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-4cV","jetpack_featured_media_url":"","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/16177","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/users\/143524195"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/comments?post=16177"}],"version-history":[{"count":10,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/16177\/revisions"}],"predecessor-version":[{"id":20023,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/16177\/revisions\/20023"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/media?parent=16177"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/categories?post=16177"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/tags?post=16177"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}