MaMi - first malware of MacOS in 2018 hits

CIOReview Team | Wednesday, 31 January 2018, 04:36 IST

  •  No Image

Way back in 2012 we faced DNSChanger Malware which affected millions of Windows PC and in the first week of 2018 we have observed the emergence of a DNSChanger Malware for MacOS. The threat was first discovered by Patrick Wardel and has been named as MaMi.

Similar to DNSChanger, MaMi's infection vector involves various recently registered domains from where it is downloaded and subsequently installed. Post infection, MaMi forcibly changes the DNS entry and also installs a root certificate. Furthermore, it is highly persistent and reverts back to malicious DNS entries, when victims manually try to change it. 

Previously, there existed another malware which infected windows Systems "DNSUnlocker" incidentally used the same subnet, furthermore the root certificates which are installed on the victims systems too are similar.

How does MaMi function?

·   Installs a local certificate - Installation of root certificate allows the threat to perform an effective MITM attack, which may range from stealing logon credentials to ad insertions.

·   Set up custom DNS settings - The DNS IP added by MaMi are under the control of the criminals and they may resolve every request by the victims and redirect them to malicious domains or Advertisements controlled by the criminals.

·   Take screenshots - of the desktop

·   Run AppleScripts - Ability to execute script allows the Trojan to execute tasks as per the defined payload

·   Get OS launch persistence - At system startup load itself

·   Download and upload files - allows to steal sensitive files and in all probability download additional modules/scripts

Indicators of Compromise:

Victims may observe the existence of the below mentioned DNS Entries:



Domains Registered by the Threat Actor:

·   angein.ingfo





How to prevent MaMi:

As was the case with DNS Changer, it is difficult to prevent MaMi from taking over an unsuspecting victim. By monitoring and blocking network machines from attempting to access the above mentioned malicious domains is one of the prevention recommendations.  Furthermore, due to the DNS Changer bot, most of the AVs have been protecting the DNS entries of the systems; hence it would be interesting to observe MaMi and the mutations it may undergo in the future.

Install and update anti-virus/malware software.

·   Keep your OS updated

·   Do not access any unsolicited website

·   Keep a backup of your data regularly

·   Do not use open Wi-Fi mostly at public places

CIO Viewpoint

The Cyber Security Spar in Integrating IT and...

By Vimal Goel, CIO, HPCL-Mittal Energy

Towards Cyber Resilience: A Data-Centric...

By Puneet Gupta, Vice President & Managing Director, NetApp India/SAARC

Why DDoS Attacks Are on the Rise and How Can...

By Shibu Paul, Vice President – International Sales at Array Networks

CXO Insights

Tailored QR Code Templates for Phishing Scams

By Sundar Balasubramanian, India and SAARC MD, Check Point Software Technologies

Emerging Trends, Challenges & Future Prospects...

By Sujoy Brahmachari, CIO & CISO, Rosmerta Technologies

Exploring Data-First Security and Automation in...

By Maheswaran S, Country Manager - S.Asia, Varonis Systems