Malware News Website of HandBrake App Hacked to Spread Proton RAT for Mac Users

[Solarquest]

The website of the HandBrake app has been compromised, and one of its download mirrors modified to host a version of the Proton RAT embedded in the app's Mac client.

HandBrake is a multi-platform transcoder, an app that helps users convert multimedia files from one format to another.

According to a security alert posted yesterday on the app's forum, an unknown attacker had compromised on of the website's download mirrors, located at download.handbrake.fr.

The miscreant(s) replaced the Mac version of the HandBrake client with his own version, which also contained Proton, a Remote Access Trojan for macOS.

The Proton RAT was first spotted in March when a crook put it up for sale on an underground hacking forum. The RAT can be used to steal data from infected devices, but also to allow attackers to connect via VNC or SSH to infected hosts.

Download mirror compromised for four days
According to the HandBrake team, their servers were compromised between May 2, 2017, 14:30 UTC and May 6, 2017, 1:00 UTC. Users who downloaded HandBrake for Mac 1.0.7 are most likely compromised.

"If you see a process called 'Activity_agent' in the OSX Activity Monitor application. You are infected," HandBrake developers say.

The SHA256 of the infected HandBrake file is 013623e5e50449bbdf6943549d8224a122aa6c42bd3300a1bd2b743b01ae6793. A VirusTotal scan of this file doesn't list any infection, but this was one of Proton's advertised features, as being "undetectable."

.....

 

[Ink]

More information for identification and removal instructions
Mirror Download Server Compromised - HandBrake

 

[shmu26]

No detections on VT. Pretty good!

 

[Winter Soldier]

No detections on VT. Pretty good!

Yes, I'd like to know the programming language of this sample, if it was written in Objective C, I think some of the other AVs would have detected the malware, at least according to the heuristic.

 

[shmu26]

Yes, I'd like to know the programming language of this sample, if it was written in Objective C, I think some of the other AVs would have detected the malware, at least according to the heuristic.

So the thing is they wrote it specifically for Mac, and Mac is less developed in security software. Maybe that's why it went undetected?

 

[Winter Soldier]

So the thing is they wrote it specifically for Mac, and Mac is less developed in security software. Maybe that's why it went undetected?

No idea but I do not know the programming language; in the case of OC, it probably would have been detected on VT also by the antivirus that work on Windows systems because of the affinity with C/C++ (heuristic level).

 

[orphyone]

The website of the HandBrake app has been compromised, and one of its download mirrors modified to host a version of the Proton RAT embedded in the app's Mac client.

HandBrake is a multi-platform transcoder, an app that helps users convert multimedia files from one format to another.

According to a security alert posted yesterday on the app's forum, an unknown attacker had compromised on of the website's download mirrors, located at download.handbrake.fr.

The miscreant(s) replaced the Mac version of the HandBrake client with his own version, which also contained Proton, a Remote Access Trojan for macOS.

The Proton RAT was first spotted in March when a crook put it up for sale on an underground hacking forum. The RAT can be used to steal data from infected devices, but also to allow attackers to connect via VNC or SSH to infected hosts.

Download mirror compromised for four days
According to the HandBrake team, their servers were compromised between May 2, 2017, 14:30 UTC and May 6, 2017, 1:00 UTC. Users who downloaded HandBrake for Mac 1.0.7 are most likely compromised.

"If you see a process called 'Activity_agent' in the OSX Activity Monitor application. You are infected," HandBrake developers say.

The SHA256 of the infected HandBrake file is 013623e5e50449bbdf6943549d8224a122aa6c42bd3300a1bd2b743b01ae6793. A VirusTotal scan of this file doesn't list any infection, but this was one of Proton's advertised features, as being "undetectable."

.....

Just goes to show, check yo hashes!