Description of Campaign
A new variant of the Shlayer malware that affects Mac OS X has been observed in the wild. On June 15, 2020, the newly identified variant of the trojan was seen being delivered through search engine results. After the malicious link is clicked, the user is taken through multiple redirects and finally presented with an Adobe Flash Player update. The user is given instructions on how to download and install the Adobe Flash update. But, the legitimate update is bundled with adware and spyware that is also installed on the victim’s computer. Trellix Labs will continue to monitor and update the Shlayer trojan profile and disseminate information that is deemed appropriate for the Shlayer trojan and affected victims.

How to use this article:

1. If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign. 
2. Review the product detection table and confirm that your environment is at least on the specified content version.
   To download the latest content versions, go to the Security Updates page.
3. Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
4. Review KB91836 - Countermeasures for entry vector threats.
5. Review KB87843 - Dynamic Application Containment rules and best practices.
6. Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

Campaign IOC
  

Type	Value
SHA256	2C2C611965F7B9C8E3524A77DA9B2EBEDF1B7705E6276140CFFE2C848BFF9113
SHA256	05B9383B6AF36E6BF232248BF9FF44E9120AFCF76E50AC8AA28F09B3307F4186
SHA256	907C31B2DA15AA14D06C6E828EEF6CA627BD1AF88655314548F747E5ED2F5697
SHA256	97EF25AD5FFAF69A74F8678665179B917007C51B5B69D968FFD9EDBFDF986BA0
SHA256	86561207A7EBEB29771666BDC6469D81F9FC9F57EEDDA4F813CA3047B8162CFB
SHA256	D49EE2850277170D6DC7EF5F218B0697683FFD7CC66BD1A55867C4D4DE2AB2FB
Domain	youdontcare.com
Domain	yougotupdated.com
Domain	installerapi.com
Domain	flashdownloader.pro
Domain	defenderbrowser.com
Domain	installvibes.com

 

Minimum Content Versions:

Content Type	Version
V2 DAT (VirusScan Enterprise)	9661
V3 DAT (Endpoint Security)	4113

 
 
Detection Summary           
 

IOC	Scanner	Detection
2C2C611965F7B9C8E3524A77DA9B2EBEDF1B7705E6276140CFFE2C848BFF9113	AVEngine V2	OSX/Shlayer.o
	AVEngine V3	OSX/Shlayer.o
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
05B9383B6AF36E6BF232248BF9FF44E9120AFCF76E50AC8AA28F09B3307F4186	AVEngine V2	OSX/Shlayer.o
	AVEngine V3	OSX/Shlayer.o
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
907C31B2DA15AA14D06C6E828EEF6CA627BD1AF88655314548F747E5ED2F5697	AVEngine V2	OSX/Shlayer.o
	AVEngine V3	OSX/Shlayer.o
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
97EF25AD5FFAF69A74F8678665179B917007C51B5B69D968FFD9EDBFDF986BA0	AVEngine V2	OSX/Shlayer.o
	AVEngine V3	OSX/Shlayer.o
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
86561207A7EBEB29771666BDC6469D81F9FC9F57EEDDA4F813CA3047B8162CFB	AVEngine V2	OSX/Shlayer.o
	AVEngine V3	OSX/Shlayer.o
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
D49EE2850277170D6DC7EF5F218B0697683FFD7CC66BD1A55867C4D4DE2AB2FB	AVEngine V2	OSX/Shlayer.o
	AVEngine V3	OSX/Shlayer.o
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

                                             
Minimum set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.
Endpoint Security - Advanced Threat Protection:
Aggressive set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.
Host Intrusion Prevention: