Shub Stealers Fake Crypto Apps

By: Jason Reaves Shub Stealer[1] which looks very similar to MacSync also leveraged the same obfuscator on their shellscript[2] that is very popular lately. Shell script: fd674425d3fc0d95bbc90dcd598eabdb2ddd77037954c8a1d1175f118d1e8dddAfter decoding however it is a bit different as it includes a number of checks: #!/bin/zsh # Debug loader — detect CIS and block with telemetry IS_CIS="false" if…

This is an excerpt. The full article continues at Walmart Global Tech.