New Malware campaign on MacOS

Malicious sponsored Google ads, as fake tutorials to clean up your mac storage.

Attack Flow

Background Story

In the shady afternoon, after I prayed, I Opened my laptop and saw that it was running low on storage capacity. As someone who likes everything free (Open-Source Enthusiast, xD), I search in the internet about how to clean up my storage on my laptop.

R.I.P my storage :(

And then, I found some interesting article on the top of my search.

Source: cube-team[dot]com (its just link to redirect to page, there is nothing malicious with that)

Things that surprised me and made me laugh a little appeared.

It’s a bit ridiculous that it’s on a website. I thought like is it possible for a company to shows such a blog like that. My first steps is validating that domain.

scanned cube-team[dot]com in virustotal

There is nothing suspicious with that domain, but when Im checking the details page, it shows that this link’s final destination is in the malicious link.

And you can see the result in virustotal for the final URL in here. Also im visiting the other page of the website, and its totally typosquatting.

Typosquatting, also known as URL hijacking, is a type of cyberattack where attackers register domain names that are intentionally misspelled versions of popular websites. The goal is to trick users who make common typographical errors when typing website addresses into their browsers, leading them to the attacker’s fraudulent website.

Digging into what’s really going on

Back to that suspicious article, Im decode that base64

Downloaded safely for that file, There is nothing encoded or encrypted with something, its just a plain shell script, with the malicious action.

At first, it will store your username and ask for your password, it will loop until you entered your correct password. After that, it will downloaded another file, called update, saved in /tmp/update . That password will used to give the attackers root access and use xattr to remove com.apple.quarantine attributes.

xattr com.apple.quarantine command causes the OS to skip the malware check for the file specified; it normally gets removed if it doesn’t find any in it. Running it should only be done if the computer falsely detects some and it’s from a trusted source.

After that, the shell script tells the computer that this program allow to be executed use chmod + x /tmp/update , and finally the program is executed. And at the end of the script, it gathers OS, version, language to tailor attacks or evasion methods. It also likely to track for which campaign resulted in infection. In this case, the website and id’s most likely to track for which campaign resulted in infection.

Going deeper and deeper

After successfuly download the update file, I uploaded it in virustotal with this result.

File Information

Thats a big sign that this is a serious malware. The malware is highly obfuscated with some operations such as XOR, Mersenne Twister PRNG (MT19937), and other complex mathematic operations.

Move to my Hex-Rays IDA, I start to pinpoint some essential function with their task.

The payloads is hard to be decoded to plain, because the highly obfuscated and PRNG operations make me almost impossible to statically analyze.

Back in the virustotal, the first interaction from the malware to the shell is

That’s indicate thats the attacker didn’t want to his program is executed in virtualization or suspicious environment. And that’s one of the payloads.

Patching the binary

At this moment, Im already a little stuck. Ask my friends, he have an idea to patch the binary to bypassing the anti-vm.

original binary
patched binary

But its nothing, it still can’t help, I think Im lost now. Also, this was my first time analyzing and seeing a real malware in my life. Im out for this like 4–5 hour to take a break.

Reckless Action

Im back in front of my laptop with fresh mind, but with wild action. We know that if we run manually (not use shell script) in terminal and the executable trying to access some directory, it will need our permission. So, I run that malware and wait to ask for permission appear with seeing the process running use ps aux . Apparently, the payload created by the attacker is not too good to hide. When the ask for permission appear, all the payload is recorded in process too (I think the payload appear for ask permission is just the starting payload to give this malware permission).

screenshot from my friend when Im running the malware

So, after i copying the payload, Im rejected the permission and kill all malicious process in my laptops, and its controlled and safe.

Lets move to analyze the real payloads the attacker want to execute. I already cleared the payload so it easy to read. This is the osascript the attackers create.

There is some key malicious components.

malicious function

So, the flow is first, it will pop a window for the victim to give their password for the beginning of the attack. Then, it will travels in victim’s computer to collect all data and compress it. Then the data will send back to the attackers. Along with that, the attacker plants a backdoor as a shortcut for them to access the victim’s computer again.

Layered Malware

I already mention that its not just one straight attack, the first malware stealing and drop another malware in victims computer. I grab the new malware based on that payload above, and upload it in VirusTotal.

I notice that the first submission for this file is when Im upload this file. So that means that this malware is new and need to be analyzed further immediately.

Lesson Learned

If you looking for something free, the internet its always have it. But dont let you be ignorant and not check on it. Always be careful in doing everything on the internet.

Just because the internet feels limitless doesn’t mean our actions should be careless.

Suggestion

Sharing what we uncover about new malware isn’t just helpful — it’s a vital part of staying ahead in the fight against evolving cyber threats. Also, it will be very helpful if you want to continues for this findings.

IoCs

update (Mach-O): b69072b11af4a213a048b171933193330e368f25662d330056d825089680d610 SHA256

app (Mach-O):

b4858bb826e942864094b05f7f92cfa22a5323b1e7240509b0f9e9defd5db47a SHA256

Domain related to update: adrianfrieg[dot]com, uznbhw[dot]com , cube-team[dot]com

Domain related to app: halesmp[dot]com

C2 IP Server related to app: 45.94.47.144

Persistence file: /Library/LaunchDaemons/com.finder.helper.plist

Backdoor executable: /Users/[your_username]/.agent, /Users/[your_username]/.helper

Targeted apps for trojan replacement: /Applications/Ledger Live.app

PreviousResearch

Last updated