OceanLotus' macOS backdoor blossoms into more evolved version

itman · Jun 26, 2017

The alleged Vietnamese ATP group OceanLotus has evolved its Mac spyware trojan, creating what researchers at Palo Alto Networks are calling" one of the more advanced backdoors we have seen on macOS to date."

This newer rendition of the backdoor malware has added decoy documents, string encoding, modularity, and custom binary protocol traffic with encryption, while eliminating command-line utilities. Like past versions, the malware is being used primarily within Vietnam itself.
Click to expand...

https://www.scmagazine.com/oceanlot...oms-into-more-evolved-version/article/670879/

guest · Apr 9, 2019

OceanLotus: macOS malware update
Latest ESET research describes the inner workings of a recently found addition to OceanLotus’s toolset for targeting Mac users
April 9, 2019
https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/

This article details what has changed from the previous macOS version analyzed by Trend Micro and describes how, while analyzing this variant’s code, you can automate string decryption using the IDA Hex-Rays API.
Anti-debug and anti-sandbox
As usual for OceanLotus macOS binaries, the sample is packed with UPX, but most packer identification tools do not recognize it as such, probably because they mostly include a signature that relies on the presence of a “UPX” string, and further, Mach-O signatures are less common and not as regularly updated. This particular characteristic makes static detection more difficult. [...]
Conclusion
As recently documented in another of our articles, the OceanLotus group keeps improving and updating its toolset, and once again, it has improved its tools for targeting Mac users. The code has not changed that much, but because many Mac users don’t run security software on their machines, the need to evade detection is of less importance.
Click to expand...

Log in or Sign up

OceanLotus' macOS backdoor blossoms into more evolved version

itman Registered Member

guest Guest

Log in or Sign up

OceanLotus' macOS backdoor blossoms into more evolved version

itman Registered Member

guest Guest

Useful Searches