How MosaicLoader Malware Evade Security Detection?

Researchers uncovered another malware that used paid ads to deliver the malware to the victim. The new malware used a unique technique to hide among Windows Defender exclusions to stay undetected. The malware adds two files or processes, prun.exe, and appsetup.exe to the local list of Windows Defender exceptions to evade detection. It is named ‘MosaicLoader’ for two reasons: Its internal structure aims to confuse the reverse-engineering process and its unique strategy to evade detection. In this article, we will tell some details about the malware along with how MosaicLoader malware evade security detection.

Summary Of MosaicLoader Malware:

“MosaicLoader malware is basically a downloader that can deliver any payload to the infected system. It is seemingly delivered through paid ads in search results designed to lure users looking for cracked software to infect their devices. Once planted on the system, the malware creates a complex chain of processes and tries to download a variety of threats, from simple cookie stealers to cryptocurrency miners or more complex ones, such as the Glupteba Backdoor.”

Victims Of MosaicLoader Malware:

The MosaicLoader malware campaign doesn’t appear to be targeted on a specific country, reign, organization, community, or group. It just ran paid ads across the globe. The users who search for cracked versions of software on the search engines are most likely hit by the MosaicLoader malware. We can say that the malware trapped mostly personal computers.

How MosaicLoader Malware Evade Security Detection?

Here are some of the techniques used to evade security detection:

How Do Users Get Infected With MosaicLoader Malware?

The execution flow of the MosaicLoader malware is quite linear.

Appsetup.exe:

Appsetup.exe adds a new registry value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Prun that will point to the other component of the second stage, C:\Program Files (x86)\PublicGaming\prun.exe. Appsetup.exe creates a service called pubgame-updater, which runs periodically to make sure the registry key exists. The service will create the registry key if it gets cleaned up.

prun.exe:

prun.exe is used to guard the payload. prun.exe is used to obfuscate the date and break it into smaller chunks. This technique makes code hard to follow while reverse-engineering. prun.exe uses few anti-debugging techniques. It kept the CPU busy during the time of execution. Another anti-debugging trick that might discourage some reverse-engineers is spamming lots of exceptions that trap the execution to the debugger.

Recommendations To Prevent MosaicLoader Malware Infections:

Mosaicloader Miter Att&CK Matrices

Mosaicloader Indicators of Compromise:

Hashes:

Downloaders
d724066d7c19b29b2bdb7468a9027f1b
953ebbee1cc0fe28595ef92277ee1824
d9ecaa2b2ac1902805ca96b7f6803028
62828deec03544193a8b7af50b587c64
51ef12de306029e18ad25802b0acfbb2
dd2d93e538f05295700a371976b057c9
f3481078c22a26ecd6ab9f653e6be075
09ca3264faa0092b6704bf77e72fa5df
91f545054d5188d0a61e9aa39f38f02d
d7a8d70022085464f05888ef6575d8ec
bda968ba8dc4a7351f1af40549e87713
fe5d1d2a2a9a4b61d237546d5896599e
90070741e9c025f841f47f0c3adee3d2
cd6e4a9e65bd9e1e3aae77400161ead0
74f40695d6e8b7554652a2ccab0e24e4
c2595f372f0c55e3add27b1987ab7273
bb31f608469d58ccd816033dc5740942
f08910c2927c583531dd1da85d3644b4
eb23ded8126b43ea056ff579aa69ea52
307cf83afc07a789f7b8976bb9fbb607
482f23f6deaaa4917c2102d22a3cf367
731a8703f88bfa1c429c721b90383357
fb3be97affe515876a7e636c22ffa36f
d4b5cbd0982a44206dbfe98a31eded10
982bfe7514223c1d65be764422d1cf19
a238e40e91da8ff1c1c4a9f3a59c52a2
ac8dc817e5d387eac8894e6956e64f99
3786ebdb146a3355652cb90206f3f442
cd8dcbbf2270ec08b28dc2b823a5a786
a0686d8651b078faa60f75295f75e191
5c7623b207bf5756a641d05016f57350
fdc3c72f4249d05c7847009e4c0962bf
ec1a7ad5bc45ff82ac8552b9b4de2d0d