AMOS Trojanized Wallet Application Replacement
This rule detects the forced removal of legitimate cryptocurrency wallet applications (Ledger Wallet, Trezor Suite, Exodus) followed by the extraction of new applications into the /Applications directory on macOS. It also looks for chmod commands to make the new applications executable and attempts to download suspicious zip files from 'wusetail.com'. This activity is indicative of the AMOS malware campaign, which aims to replace legitimate wallet applications with trojanized versions to steal cryptocurrency.
Splunk (SPL)
