MacSync under the microscope: new delivery methods and a new payload

MITRE Techniques

• [T1059.002 ] Command and Scripting Interpreter: AppleScript – Used in earlier stages and in command delivery to execute malicious logic and wrappers (‘payloads were implemented as AppleScripts’; ‘extract the base64-encoded AppleScript script… and execute it’).
• [T1059.004 ] Command and Scripting Interpreter: Unix Shell – Used to run zsh, feed commands from the calendar, and execute scripts directly in memory (‘launches the interpreter to read commands from standard input (zsh -s)’).
• [T1027 ] Obfuscated Files or Information – Multiple strings, URLs, configs, and payloads were XOR/AES encrypted and hidden in overlays or static arrays (‘XOR-encrypted URL’; ‘Many strings… are XOR-encrypted’).
• [T1140 ] Deobfuscate/Decode Files or Information – Malware decodes XOR-encrypted URLs and decrypts AES-wrapped payloads and keys (‘decrypts it with the key’; ‘The ciphertext is decrypted with AES in GCM mode’).
• [T1218 ] System Binary Proxy Execution – Legitimate macOS utilities were abused to run attacker content, including xattr, zsh, ptrace, sysctl, and security (‘runs the xattr -cr command’; ‘launches the interpreter’).
• [T1105 ] Ingress Tool Transfer – Payloads and modules were downloaded from attacker servers and iCloud locations (‘download a .TAR.GZ archive from iCloud’; ‘retrieves the next-stage payload from the command-and-control server’).
• [T1132.001 ] Data Encoding: Standard Encoding – Base64 was used to encode keys and public keys sent to the server (‘The public key is encoded in base64’).
• [T1041 ] Exfiltration Over C2 Channel – Stolen data was uploaded to the command-and-control server via PUT requests and chunked uploads (‘The stolen data is uploaded to the command-and-control server via PUT requests’).
• [T1547.001 ] Boot or Logon Autostart Execution: Launch Agent – Persistence was established with a LaunchAgent named com.apple.finder.agent (‘A LaunchAgent named com.apple.finder.agent’).
• [T1546.008 ] Event Triggered Execution: System Profile / Shell Configuration Modification – Persistence was added by injecting commands into .ZSHRC and Git hooks (‘inject a malicious command into the .ZSHRC’; ‘global GIT pre-commit and post-checkout hooks’).
• [T1057 ] Process Discovery – The stealer collects a list of running processes as part of system information (‘list of installed applications and running processes’).
• [T1082 ] System Information Discovery – The stealer gathers hardware, device model, UUID, and other host details (‘device model, hardware, UUID, and so on’).
• [T1555 ] Credentials from Password Stores – The malware targets keychain and browser credential stores (‘Keychain file’; ‘browser data… saved logins and passwords’).
• [T1552.001 ] Unsecured Credentials: Credentials In Files – It searches for configuration files and history files that may contain secrets (‘Configuration files for SSH, ZSH, AWS, Kubernetes, GIT’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – It uses anti-debugging and kills notification-related processes to hinder analysis and user notification (‘sets the PT_DENY_ATTACH flag’; ‘kills the BTMNotificationAgent, NotificationCenter, and BackgroundTaskManagementAgent’).