In March 2019, a new sample of malware for macOS from the OceanLotus cyber group was uploaded to VirusTotal, a popular online scanning service. The executable file of the backdoor possesses the same capabilities as the previously studied version of the malware for macOS, but its structure has changed, making it harder to detect. Unfortunately, we were unable to find the dropper associated with this sample, so we do not yet know the infection vector.
Recently, we published and how the operators attempt to ensure persistence, accelerate code execution, and minimize traces of presence in Windows systems. It is also known that this cyber group has a component for macOS. This post details the changes in the latest version of the malware for macOS compared to the previous one (), as well as how the analysis can automate the decryption of strings using the IDA Hex-Rays API.
Analysis
The following three parts describe the analysis of the sample with the SHA-1 hash E615632C9998E4D3E5ACD8851864ED09B02C77D2. The file is named flashlightd, and ESET's antivirus products detect it as OSX/OceanLotus.D.
Anti-debugging and sandbox protection
Like all OceanLotus macOS binaries, the sample is packed with UPX, but most packer identification tools do not recognize it as such. This is likely because they mainly contain a signature that depends on the presence of the string “UPX,” and Mach-O signatures are rarer and not updated as often. This feature complicates static detection. Interestingly, after unpacking, the entry point is at the beginning of the section __cfstring in the segment .TEXT. This section has flag attributes, as shown in the figure below.
Figure 1. MACH-O section __cfstring attributes
As shown in Figure 2, the code locations in the section __cfstring allow some disassembly tools to be deceived by displaying the code as strings.
Figure 2. The backdoor code is identified by IDA as data
After execution, the binary creates a thread as a means of anti-debugging, with the sole purpose of constantly checking for the presence of a debugger. To do this, the thread:
— Attempts to detach any debugger by calling ptrace with PT_DENY_ATTACH as a request parameter
— Checks if certain exception ports are open by calling the function task_get_exception_ports
Checks if the debugger is connected, as shown in the figure below, by verifying the presence of the flag P_TRACED in the current process
Figure 3. Checking for debugger connection via the sysctl function
If the watchdog scheme detects the presence of a debugger, it calls the function sigreturn. Additionally, the sample then checks the environment by executing two commands:
ioreg -l | grep -e "Manufacturer" and sysctl hw.model
After that, the sample checks the return value against a hardcoded list of known virtualization system strings: acle, vmware, virtualbox or parallels. Finally, the next command checks whether the machine is one of the following: 'MBP', 'MBA', 'MB', 'MM', 'IM', 'MP' and 'XS'. These are model codes for the system; for example, 'MBP' means MacBook Pro, 'MBA' means MacBook Air, etc.
system_profiler SPHardwareDataType 2>/dev/null | awk '/Boot ROM Version/ {split($0, line, ":");printf("%s", line[2]);}'
Main Additions
Although the backdoor commands have not changed since the Trend Micro research, we have noticed a few other modifications. The C&C servers used in this sample are quite new, created on 10/22/2018.
— daff.faybilodeau[.]com
— sarc.onteagleroad[.]com
— au.charlineopkesston[.]com
The resource URL has changed to /dp/B074WC4NHW/ref=gbps_img_m-9_62c3_750e6b35.
The first packet sent to the C&C server contains more information about the host machine, including all data collected by the commands in the table below.
In addition, changes to the configuration show that the sample uses an external library for network filtering, not the library , to find it, the backdoor attempts to decrypt each file in the current directory using AES-256-CBC with a key gFjMXBgyXWULmVVVzyxy, padded with zeros. Each file is decrypted and saved as /tmp/store, and an attempt to load it as a library is made using the function . When the decryption attempt leads to a successful call to dlopen, the backdoor extracts the exported functions Boriry and ChadylonV, which apparently handle network interaction with the server. We do not have a dropper or any other files from the original sample location, so we cannot analyze this library. Furthermore, since the component is encrypted, a YARA rule based on these strings will not match the file found on disk.
As described in the aforementioned article, a clientIDThis identifier is the MD5 hash of the returned value from one of the following commands:
— ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split($0, line, ""); printf("%s", line[4]); }'
— ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, ""); printf("%s", line[4]); }'
— ifconfig en0 | awk '/ether/{print $2}' (get MAC address)
— unknown command (“x1ex72x0a“), which is used in the previous samples
Before hashing, a character "0" or "1" indicating the presence of root privileges is added to the returned value. This clientID is stored in /Library/Storage/File System/HFS/25cf5d02-e50b-4288-870a-528d56c3cf6e/pivtoken.appex, if the code is run as root or in ~/Library/SmartCardsServices/Technology/PlugIns/drivers/snippets.ecgML in all other cases. The file is usually hidden using the , its timestamp is changed using the command touch -t with a random value.
String Decryption
As in previous versions, strings are encrypted using AES-256-CBC (hexadecimal key: 9D7274AD7BCEF0DED29BDBB428C251DF8B350B92 padded with zeros, and IV filled with zeros) via the function . The key has changed compared to previous versions, but since the group still uses the same string encryption algorithm, decryption can be automated. In addition to this post, we release an IDA script that uses the Hex-Rays API to decrypt strings present in the binary file. This script can assist in future OceanLotus analysis and analysis of existing samples we haven't been able to obtain yet. The core of the script is a universal method for obtaining arguments passed to the function. Additionally, it searches for parameter assignments. The method can be reused to obtain a list of function arguments and then pass them to a callback.
Knowing the function prototype decrypt, the script finds all cross-references to this function, all arguments, then decrypts the data and places the plaintext inside a comment at the cross-reference address. For the script to work correctly, a custom alphabet used by the base64 decoding function must be set up, and a global variable defining the key length (in this case, DWORD, see Figure 4) must be established.
Figure 4. Defining the global variable key_len
In the Function window, you can right-click the decryption function and click 'Extract and Decrypt Arguments.' The script should place the decrypted strings in comments, as shown in Figure 5.
Figure 5. The decrypted text is placed in the comments
This way, the decrypted strings are conveniently grouped together in the IDA window. xrefs for this function, as shown in Figure 6.
Figure 6. Xrefs to the function f_decrypt
The final version of the script can be found at .
Output
As already mentioned, OceanLotus continually improves and updates its toolkit. This time, the cyber group enhanced the malware for Mac users. The code has not changed significantly, but since many Mac users ignore security products, malware protection from detection has become a secondary concern.
ESET products had already detected this file by the time of investigation. As the network library used for C&C communication is now encrypted on disk, the exact network protocol used by the attackers is still unknown.
Indicators of Compromise
Indicators of compromise and MITRE ATT&CK attributes are also available at .
Source: habr.com
