Rewterz Threat Alert – XCSSET Mac Malware adapts to target macOS 11 and M1-based Macs – IOCs

Severity

High

Analysis Summary

In August of 2020, Trend Micro researchers spotted malware that spread through the Xcode projects and targeted systems to steal sensitive information and launch ransomware attacks. Applications like Evernote, QQ, skype, WeChat, Notes, and Telegram were infected by the malware. The malware allowed attackers to exfiltrate stolen documents from targeted systems and capture screenshots. It was also able to implement ransomware behavior by encrypting files and displaying ransomware notes.

The malware was also able to launch UXSS (universal cross-site scripting) attacks to inject JavaScript code into browsers while visiting specific websites and impacting user’s browsing experience. This allowed the malware to replace cryptocurrency addresses with malicious codes. Credentials of online services like Apple ID, Paypal, Google, and Yandex and payment card information from Apple were stolen.

While Trend Micro discovered two Xcode projects injected with the XCSSET Mac Malware in 2020, Kaspersky has discovered a new variant of the malware compiled for devices with M1 chips. 

“While exploring the various executable modules of XCSSET, we found out that some of them also contained samples compiled specially for new Apple Silicon chips. For example, a sample with the MD5 hash sum 914e49921c19fffd7443deee6ee161a4 contains two architectures: x86_64 and ARM64.” states the report published by Kaspersky.

“The first one corresponds to previous-generation, Intel-based Mac computers, but the second one is compiled for ARM64 architecture, which means that it can run on computers with the new Apple M1 chip.”

The XCSSET Mac Malware now supports both x86_x64 and ARM64 architectures, and in addition to M1 chips, XCSSET malware also fits with macOS 11 Big Sur.

Impact

• Ransomware
• Credential Theft
• Financial Information Theft
• File encryption

Affected Products

ARM-based M1 processors

Indicators of Compromise

Domain Name

• Adoberelations[.]com
• Findmymacs[.]com
• Statsmag[.]com
• Statsmag[.]xyz
• Titian[.]com
• Trendmicronano[.]com

Filename

• replicator[.]applescript
• safari_remote[.]applescript
• pods_infect[.]applescript
• cat
• screen_sim[.]applescript
• Pods shellscript
• Pods
• cat shellscript
• bootstrap[.]applescript

IP

• 94[.]130[.]27[.]189

SHA-256

• 3631d9485d2e61bb86a71a007d5420d132938cc1f9dacbc6d2eef0dcd8dc040c
• 5acf6821d44545bfcd3446e2bdf589bc16972f76cc9137cb364954829df520d2
• 66057e5672a0e3c564563f99881fc57b604e6c91a992b6a937d0077636200497
• 74df6fee1c5d18dc8f0dad1263199ab4392088fd5faaae95ae05b377207fff05
• 86f3195ea91953e0e560ac474e34218a919c89ba433dc3a1eb935800b2acb7f7
• 8aaf02565161bd88f033d2419104a4cb452a4808363b05cdff43b5781f78e01d
• a018213ac9202119eb7a6d58603f8dbb2fdde26b9639d852e5e426ecbfc3545f
• a191c9657abbc528640bd2217f479fbecb33c85ca0e37a2ea309225bb0cbf2ce
• cdbc86b5828fc6e8f9747bbd298bdf19d0047622c9e69f9b0877ee4106b3768

Remediation

• Block all threat indicators at your respective controls.
• Download applications from credible, official, and legitimate marketplaces.
• Search for IOCs in your environment.