{"id":2491,"date":"2022-01-16T19:41:06","date_gmt":"2022-01-16T19:41:06","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/16\/custom-written-malware-discovered-across-windows-macos-and-linux-systems\/"},"modified":"2022-01-16T19:41:06","modified_gmt":"2022-01-16T19:41:06","slug":"custom-written-malware-discovered-across-windows-macos-and-linux-systems","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/16\/custom-written-malware-discovered-across-windows-macos-and-linux-systems\/","title":{"rendered":"Custom-written malware discovered across Windows, macOS, and Linux systems"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

Why it matters:<\/strong> In December 2021, the security team at Intezer identified custom-written malware on a leading educational institution’s Linux web server. The malware, since named SysJoker, was later discovered to also have Mac and Windows-based variations, increasing its ability to infect desired systems. The macOS and Linux variations are currently undetectable by most antivirus products and scanners. <\/p>\n

The custom-written, C++ based remote access trojan (RAT) that went completely undetected for several months may have been released around mid to late 2021. Named SysJoker<\/a> by Intezer’s security team, the program conceals itself as a system update within the target’s OS environment. Each variation of the malware is tailored to the operating system it targets, many of which have proven to be difficult or impossible to detect. According to VirusTotal<\/a>, an antivirus and scan engine aggregator, the macOS and Linux versions of the program are still undetectable.<\/p>\n

The RAT’s behavior is similar across all of the impacted operating systems. Once executed, it creates and copies itself to a specific directory masquerading as Intel’s Graphics Common User Interface Service, igfxCUIService.exe<\/a>. After several other actions are executed, the program will begin collecting machine information such as the MAC address, serial numbers, and IP addresses.<\/p>\n

Intezer’s blog post provides a fully detailed explanation<\/a> of the malware’s behavior, decoding and encoding schemes, and command and control (C2) instructions.<\/p>\n

\"\"<\/picture><\/p>\n

The blog provides readers with detection and response steps that can be followed to determine if your organization was compromised and what next steps to take. Intezer Protect can be used to scan for malicious code on Linux-based systems. The company provides a free community edition<\/a> of the product to conduct scans. Windows systems are advised to use Intezer’s endpoint scanner<\/a>. Owners of compromised systems are advised to:<\/p>\n