MosaicLoader malware targets software pirates

By Dylan Bushell-Embling
Thursday, 22 July, 2021

MosaicLoader malware targets software pirates

Bitdefender has discovered a new malware family capable of delivering any payload to an infected system that uses sophisticated methods to avoid detection and prevent reverse engineering by security researchers.

The malware, which Bitdefender has named MosaicLoader, appears to be delivered through paid ads in search results targeting users looking for cracked software.

The downloader malware adds local exclusions to Windows Defender for specific file names residing in a folder named \PublicGaming\.

Once planted on a system, the malware creates a complex chain of processes and downloads a malware sprayer that itself tries to download a variety of threats, ranging from simple cookie stealers and cryptocurrency miners to more complex threats such as the Glupteba Backdoor.

The process includes a number of methods aimed at confusing researchers, including heavy code obfuscation, the use of mathematical operations with large numbers to obtain values required by the program and a series of filler bytes designed to be skipped over in the code.

The attack campaign analysed by Bitdefender has no specific target countries or organisations, but a number of infections were identified in Australia, the company said.

Bitdefender added that the best way to defend against MosaicLoader is to simply avoid attempting to install pirated software.

Image credit: ©lollo/Dollar Photo Club

Related News

Ransomware gangs consecutively attacking

Three prominent ransomware gangs have adopted a combined approach that sees consecutive attacks...

Companies rethinking security strategies for hybrid

Organisations are increasing investments in technologies that allow them to provide a simpler,...

Aussie orgs still struggling to identify cyber risk

New research from Trend Micro has revealed that 48% of Australian organisations feel their cyber...

  • All content Copyright © 2022 Westwick-Farrow Pty Ltd