Lazarus For Mac



Malware

Installing Lazarus on a Mac is unfortunately not as easy as e.g. On Windows, the Lazarus installation contains all necessary prerequisites. This is not the case on Mac OS X, where several other tools are needed: XCode the development environment of Mac, which contains some command-line tools. Gdb The gnu debugger. The Lazarus Farm Market has been in continuous operation at this location for 7 generations. We currently farm 1,000 acres. We currently have 115 different varieties of fruits and 15 varieties of berries and nuts. Our sweet corn is hand picked daily to minimize bruising and is.

We analyzed a new variant of a Mac backdoor attributed to the cybercriminal group Lazarus, observed to be targeting Korean users with a macro-embedded Microsoft Excel spreadsheet and a malicious Adobe Flash component for persistence.

Criminal interest in MacOS continues to grow, with malware authors churning out more threats that target users of the popular OS. Case in point: A new variant of a Mac backdoor (detected by Trend Micro as Backdoor.MacOS.NUKESPED.A) attributed to the cybercriminal group Lazarus, which was observed targeting Korean users with a macro-embedded Microsoft Excel spreadsheet.

Similarities to an earlier Lazarus iteration

We analyzed a malicious sample first discovered by Twitter user cyberwar_15, and found that it used an Excel document with an embedded macro, which is similar to a previous attack by the Lazarus group.

Figure 1. The spreadsheet displays a fairly known psychological test (similar to one found here); clicking on the smiley image on the top left shows a different response depending on the user’s answer.

However, unlike the previous attack that contains a different routine based on the OS the spreadsheet is running on, the macro in this file will just run a PowerShell script that connects to three C&C servers set up by the group:

Figure 2. The macro file connects to hxxps[:]//crabbedly[.]club/board[.]php, hxxps[:]//craypot[.]live/board[.]php, and hxxps[:]//indagator[.]club/board[.]php.

Figure 3. Comparison of SentinelOne’s code snippet of the malicious macro used in the abovementioned previous attack (left) and the code snippet of the recently discovered one (right). The latter shows that it no longer performs any specific action if it runs on a Mac platform. The “#If Mac Then” MacOS-specific attack does not start with malicious macros this time.

Mac app bundle contains malicious and legitimate Flash Players

Apart from the analyzed sample, @cyberwar_15, as well as Qianxin Technology, were also able to source an in-the-wild Mac app bundle suspected to be involved in the attack since it shares similar C&C servers with the malicious spreadsheets.

Figure 4. Mac app bundle inside a sample found in the wild

However, this is only a decoy since the actual Adobe Flash Player is contained as a hidden Mach-O file. The bundle contains two Flash Player files: a legitimate version and a malicious version (Trojan.MacOS.NUKESPED.B). The app will run the smaller-sized Flash Player as its main executable, which is the malicious version that only poses as a “Flash Player” by name. It also runs the legitimate Flash Player to hide its actual malicious routine.

Figure 5. The bundle contains two Flash Player files — one legitimate version and one malicious version.

Figure 6. A closer look at the bundle revealed that this Flash Player app was developed by someone named Oleg Krasilnikov, who has no relation to Adobe Inc.

When running the Mac app, the malicious Flash Player will run the legitimate one to play a decoy SWF video.

Figure 7. The SWF video, which plays a Korean song in the background, shows a collection of pictures.

Our own analysis of the sample revealed that while the video is playing, the malicious Flash Player creates another hidden file (Backdoor.MacOS.NUKESPED.A) in the following path: ~/.FlashUpdateCheck.

Figure 8. The malicious Flash Player creates a hidden file at ~/.FlashUpdateCheck while the legitimate Flash Player plays a video. Note: The symbol (~) is equivalent to the path of the current user.

Subsequently, a persistence mechanism for this hidden file is installed through dropped PLIST file ~/Library/Launchagents/com.adobe.macromedia.plist.

Figure 9. Code snippet of ~/Library/Launchagents/com.adobe.macromedia.plist being dropped. The hidden file ~/.FlashUpdateCheck is set as its autorun target.

Further inspection shows that the hidden file ~/.FlashUpdateCheck acts as the dropped Powershell script-equivalent of the Macro-embedded document. We have identified functions related to its C&C communication with the following servers:

Figure 10. Listed C&C servers located in the _DATA segment of the hidden file

The variant’s backdoor functions

To trigger the backdoor functions of Backdoor.MacOS.NUKESPED.A, it must first try to establish a connection with the abovementioned servers, craypot[.]live being the first in order. Upon successful connection, it would continue to its actual backdoor routine.

Machine

Figure 11. In this routine, the file would evaluate the server’s response and perform specific functions based on the received command number.

Figure 12. Disassembled pseudocode for backdoor functions 11, 12, and 14

Figure 13. Disassembled pseudocode for backdoor functions 18, 19, 20, 21, 24, and 25

Switch case backdoor commandFunction
2Set Sleep
3Terminate Process
11Get Host Information
12, 14Check Current Backdoor Configuration
15Update C2 and Backdoor Configuration
18, 19Execute Shell command
20Upload File
21Download File
24, 25Execute Response Directly

Table 1. The complete backdoor functions of Backdoor.MacOS.NUKESPED.A

Figure 14. The MacOS hidden file has backdoor functions that are similar to those of the executed hidden PowerShell script in the Excel spreadsheet sample (for example, the command 11 for both is the GetHostInfo function).

Lazarus For Mac

Conclusion

Unlike Lazarus’ earlier method, which used macros to download a backdoor Mac file, the samples we analyzed reveal that this attack type uses an app with a decoy while running the malicious routine to separate the entire Mac attack chain.

Cybercriminal groups such as Lazarus are expanding their scope of attack through different platforms. The Lazarus group’s shift from using a single cross-platform method for starting an attack chain to a more OS-specific crafted variant is something to take note of — and something we should expect on future related cases.

Security recommendations

To avoid attacks involving Backdoor.MacOS.NUKESPED.A, users should only download apps from official sources. This simple practice minimizes the chances of downloading a malicious app. Users can also benefit from security solutions such as Trend Micro Home Security for Mac, which provides comprehensive security and multi-device protection against cyberthreats.

Enterprises, for their part, should take advantage of Trend Micro’s Smart Protection Suites with XGen™ security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity or endpoint.

Indicators of Compromise (IoCs)

FilesSHA256sDetection Names
Album.appd91c233b2f1177357387c29d92bd3f29fab7b90760e59a893a0f447ef2cb4715Trojan.MacOS.NUKESPED.B
Flash Player735365ef9aa6cca946cfef9a4b85f68e7f9f03011da0cf5f5ab517a381e40d02Trojan.MacOS.NUKESPED.B
.FlashUpdateCheck6f7a5f1d52d3bfc6f175bf2bbb665e4bd99b0453e2d2e27712fe9b71c55962dcBackdoor.MacOS.NUKESPED.A
Portal:Mac

This portal provides an overview of development for macOS (previously marketed as Mac OS X until 2012 and OS X until 2016) with Lazarus and Free Pascal.

Development of macOS software is easy with Lazarus using the Cocoa (64 bit) widgetset. The Carbon widgetset is also available but only for 32 bit software and only up to macOS 10.14 Mojave. Apple removed the Carbon framework from macOS 10.15 Catalina (2019) - that operating system and future versions will no longer run any 32 bit software. Other widgetsets like Qt are also supported, but their use requires additional effort.

Free Pascal can also be used to develop software for Mac OS Classic and older versions of macOS (before Tiger).

Platform Portals:Android - Embedded - FreeBSD - iOS - Linux - Mac - WinCE - Windows

Topic Portals:New Users - Database Development - Game Development - Hardware and Robotics - HowTo Demos - Science and Technology - Web Development

Categories:Mac OS Classic - macOS - Unix - Objective Pascal - Objective C

This box describes the installation and use of Lazarus and Free Pascal.

FAQsedit

Basic development techniques with Lazarus and Free Pascal are described here, as well as hints for special optimization approaches.

  • Mac Catalyst for macOS and iPadOS
APIs and Headersedit
Lazarus for mac free download

FPC supports several APIs on macOS.

Lazarus Mac 64 Bit

  • Mac Local Procedure Parameters (Proposal)
Legacy Informationedit
Mac

Lazarus For Mac


Lazarus Download For Mac

Retrieved from 'https://wiki.lazarus.freepascal.org/index.php?title=Portal:Mac&oldid=139929'