s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-MAL-osx.shlayer

📛 Threat Title

Malware family: Shlayer

Category: Shlayer First seen: Last updated: Source: ThreatFox Malwares

Description

ThreatFox malware family `osx.shlayer`. Printable name: Shlayer.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain osx.shlayer VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.shlayer

IOC database

Type
domain
Value
osx.shlayer
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat TF-MAL-osx.shlayer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.shlayer

References (1)

Remediations (10)

  • OSX/Shlayer, Software S0402 | MITRE ATT&CK®
    web:attack.mitre.org

    OSX/ Shlayer : New Mac malware comes out of its shell. Retrieved August 28, 2019. Phil Stokes. (2020, September 8). Coming Out of Your Shell: From Shlayer to ZShlayer. Retrieved September 13, 2021. Vrijenhoek, Jay. (2018, April 24). New OSX/ Shlayer Malware Variant Found Using a Dirty New Trick. Retrieved September 6, 2019. Reed, Thomas. (2018 ...

  • BPFDoor and Symbiote Rootkits Attacking Linux Systems Exploiting eBPF ...
    web:cybersecuritynews.com

    Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.

  • Shlayer malware bypassed Apple security checks - Gridinsoft Blogs
    web:gridinsoft.com

    The first copies of the Shlayer family fell into the hands of researchers back in February 2018. At the beginning of 2020, almost 32,000 different malicious Trojan samples were collected, and were identified 143 C&C domains. Most often, Trojans of the Shlayer family download and install various adware applications on the user's device.

  • Shlayer Trojan: malware removal from Mac - MacSecurity.net
    web:macsecurity.net

    Keep abreast of the growingly treacherous Shlayer Trojan Mac campaign to find out how to avoid this malware and remove it if the attack has taken place.

  • Shlayer - Red Canary Threat Detection Report
    web:redcanary.com

    Shlayer is a macOS malware family associated with ad fraud activity through the distribution of adware applications. The trojan masquerades as an installer for applications like Adobe Flash Player and executes numerous macOS commands to deobfuscate code and install adware with persistence mechanisms.

  • The Malware Shlayer » TrainSec
    web:trainsec.net

    As Mac malware becomes more widespread and as detection mechanisms get more sophisticated, malware actors need to adapt. If not long ago, almost any variant could easily run on any machine without any scrutiny, today it needs to hop over many obstacles. From Google's safe browsing, through Apple's Xprotect and Gatekeeper, down to 3rd party AV solutions and network appliances. We ...

  • Shlayer Malware: Continued Use of Flash Updates | CrowdStrike
    web:www.crowdstrike.com

    Recent Shlayer malvertising campaigns have gone back to using fake Flash updates and social engineering tactics to trick victims into manually installing the macOS malware and compromising their systems. Although Flash Player reached end of life for macOS as of Dec. 31, 2020, this has not stopped Shlayer operators from continuing to abuse it.

  • New eBPF Filters for Symbiote and BPFdoor Malware
    web:www.fortinet.com

    FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.

  • Shlayer Trojan - How a Social Engineering Attack Is ... - MacUpdate
    web:www.macupdate.com

    A Simple Virus Made Deadly by Affiliate Networks Shlayer is a Trojan downloader that installs malware in the background, steals browsing information, and displays malicious ads. The most unique feature of Shlayer Trojan is how its distribution is actively promoted by webmasters and content owners on completely legit platforms.

  • Malwarebytes Threat Alert | Adware.Shlayer
    web:www.malwarebytes.com

    Malwarebytes for Mac detects and removes Adware. Shlayer . Remediation Malwarebytes for Mac will detect and remove the components of this malware . Download and install the latest version of Malwarebytes for Mac. Click the "Scan Now" button to perform a system scan. If threats are detected during the scan, a count of detected threats is displayed.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.