Crisis Malware Infects VMware Virtual Machines
Bangalore: Crisis, a malware discovered in last July, is now officially capable of attacking four different platforms at the same time, according to researches. Windows, Mac OS X, VMware virtual machines and Windows Mobile devices are the four environments.
According to analysts, Crisis is a computer Trojan which is basically targeted against operating systems like Mac OS and Windows. Discovered on last July by antivirus provider Intego, Crisis can also interpret and record Skype conversations, along with decoding the messages send through programs like Adium and Microsoft Messenger in Mac OS.
The malware is distributed via social sites and by downloading untrusted apps from stores. When user starts installing the app, the code within Crisis starts working and it identifies the platform of the OS that the user is working on- that is Windows or Mac OS X, which eventually results in the deployment of the corresponding installer.
"The threat searches for a VMware virtual machine image on the compromised computer and, if it finds an image, it mounts the image and then copies itself onto the image by using a VMware Player tool," said Symantec researcher Takashi Katsuki in a blog post on Monday. "This may be the first malware that attempts to spread onto a virtual machine."
On the other hand, malware producers are trying their level best to mask the upcoming release of their malware, which probably be based on other operating systems.
At the moment, reports say that the number of infected systems is not that high. According to security giant Kaspersky, the total number of victims ranged from 20 to 50 systems, that too mainly located around cities like Italy, Mexico, Iran, Turkey, Iraq, Oman, Brazil, Kazakhstan, Kyrgyzstan and Tajikistan.
