Article Content For the last few weeks, ESET has been investigating OSX/Keydnap, a malware that steals the content of the keychain while maintaining a permanent backdoor ESET analyzes multiple samples targeting OS X every day Those samples are usually potentially unwanted applications that inject advertisements into browser displays while the victim is browsing the web For the last few weeks, we have been investigating an interesting case where the purpose of the malware is to steal the content of the keychain and maintain a permanent backdoor This article will describe the components of this threat and what we know about it so far Infection vector It is still not clear how victims are initially exposed to OSX/Keydnap It could be through attachments in spam messages, downloads from untrusted websites or something else What we know is that a downloader component is distributed in a .zip file The archive file contains a Mach-O executable file with an extension that looks benign, such as .txt or .jpg However, the file extension actually contains a space character at the end, which means double-clicking the file in Finder will launch it in Terminal and not Preview or TextEdit Figure 1: Finder window with the ZIP and the malicious “.jpg ” file Figure 2: The downloader’s file information window The ZIP also contains the Resource fork that contains the icon of the executable file Once started, a Terminal window opens and the malicious payload is executed Notice the Terminal icon shows for a fraction of a second before opening Preview OSX/Keydnap downloader The downloader is an unsigned Mach-O executable Thus, if the file is downloaded from an internet browser and Gatekeeper is activated on the machine – the default in recent versions of OS X and macOS – it will not execute and display a warning to the user Figure 4: Message shown if ZIP file is downloaded from Safari Keydnap’s downloader is simple The downloader isn’t persistent However, the downloaded backdoor will add an entry to the LaunchAgents directory and survive across reboot It is described in more details in the backdoor section We have found multiple variants of the downloader executable A list of different samples can be found at the end of the article This suggests that Keydnap may be targeting users of underground forums or maybe even security researchers Also included in recent variants is a “build name” We have seen three different names: elitef*ck, ccshop and transmission Figure 5: Example decoy image (1) Figure 5: Example decoy image (2) Figure 5: Example decoy image (3) OSX/Keydnap backdoor All samples of the backdoor we have seen have the filename icloudsyncd The malware has a version string that is reported to the C&C server So far, we have seen two versions: 1.3.1 first seen in May 2016 and 1.3.5 in June While self-decompressing, the XOR is applied after decompression and before calling the main function of the original binary The Library/Application Support/com.apple.iCloud.sync.daemon directory is used to keep the icloudsyncd executable With administrator privileges, it will also change the owner of icloudsyncd to root:admin and make the executable setuid and setgid, which means it will always run as root in the future The author simply took a proof-of-concept example available on Github called Keychaindump It reads securityd’s memory and searches for the decryption key for the user’s keychain This process is described in a paper by K Lee and H Koo One of the reasons we think the source was taken directly from Github is that the function names in the source code are the same in the Keydnap malware Figure 9: Function list of Keydnap backdoor The data field is encrypted with the RC4 key “u2RLhh+!LGd9p8!ZtuKcN” without quotes The function named get_and_execute_tasks handles 10 different command types The command with ID 8 must be sent while Keydnap isn’t running as root already When issued, the backdoor will start monitoring the user’s process count When two new processes are created within two seconds, Keydnap will spawn a window asking for the user’s credentials, exactly like the one OS X users usually see when an application requires admin privileges If the victim falls for this and enters their credentials, the backdoor will henceforth run as root and the content of the victim’s keychain will be exfiltrated Figure 12: Code performing the process count check Figure 13: icloudsyncd requesting privileges We do not know what the authd_service executable managed by command ID 9 is, because we haven’t seen it used It could be a third stage malware deployed to certain targets of interest Conclusion There are a few missing pieces to this puzzle We do not know at this point how Keydnap is distributed Nor do we know how many victims there are out there Although there are multiple security mechanisms in place in OS X to mitigate malware, it’s possible to deceive the user into executing non-sandboxed malicious code by replacing the icon of a Mach-O file IoCs Samples Downloader All downloaders listed below are detected as OSX/TrojanDownloader.Keydnap.A by ESET products Marc-Etienne M.Léveillé 6 Jul 2016 - 02:30PM
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content For the last few weeks, ESET has been investigating OSX/Keydnap, a malware that steals the content of the keychain while maintaining a permanent backdoor ESET analyzes multiple samples targeting OS X every day Those samples are usually potentially unwanted applications that inject advertisements into browser displays while the victim is browsing the web For the last few weeks, we have been investigating an interesting case where the purpose of the malware is to steal the content of the keychain and maintain a permanent backdoor This article will describe the components of this threat and what we know about it so far Infection vector It is still not clear how victims are initially exposed to OSX/Keydnap It could be through attachments in spam messages, downloads from untrusted websites or something else What we know is that a downloader component is distributed in a .zip file The archive file contains a Mach-O executable file with an extension that looks benign, such as .txt or .jpg However, the file extension actually contains a space character at the end, which means double-clicking the file in Finder will launch it in Terminal and not Preview or TextEdit Figure 1: Finder window with the ZIP and the malicious “.jpg ” file Figure 2: The downloader’s file information window The ZIP also contains the Resource fork that contains the icon of the executable file Once started, a Terminal window opens and the malicious payload is executed Notice the Terminal icon shows for a fraction of a second before opening Preview OSX/Keydnap downloader The downloader is an unsigned Mach-O executable Thus, if the file is downloaded from an internet browser and Gatekeeper is activated on the machine – the default in recent versions of OS X and macOS – it will not execute and display a warning to the user Figure 4: Message shown if ZIP file is downloaded from Safari Keydnap’s downloader is simple The downloader isn’t persistent However, the downloaded backdoor will add an entry to the LaunchAgents directory and survive across reboot It is described in more details in the backdoor section We have found multiple variants of the downloader executable A list of different samples can be found at the end of the article This suggests that Keydnap may be targeting users of underground forums or maybe even security researchers Also included in recent variants is a “build name” We have seen three different names: elitef*ck, ccshop and transmission Figure 5: Example decoy image (1) Figure 5: Example decoy image (2) Figure 5: Example decoy image (3) OSX/Keydnap backdoor All samples of the backdoor we have seen have the filename icloudsyncd The malware has a version string that is reported to the C&C server So far, we have seen two versions: 1.3.1 first seen in May 2016 and 1.3.5 in June While self-decompressing, the XOR is applied after decompression and before calling the main function of the original binary The Library/Application Support/com.apple.iCloud.sync.daemon directory is used to keep the icloudsyncd executable With administrator privileges, it will also change the owner of icloudsyncd to root:admin and make the executable setuid and setgid, which means it will always run as root in the future The author simply took a proof-of-concept example available on Github called Keychaindump It reads securityd’s memory and searches for the decryption key for the user’s keychain This process is described in a paper by K Lee and H Koo One of the reasons we think the source was taken directly from Github is that the function names in the source code are the same in the Keydnap malware Figure 9: Function list of Keydnap backdoor The data field is encrypted with the RC4 key “u2RLhh+!LGd9p8!ZtuKcN” without quotes The function named get_and_execute_tasks handles 10 different command types The command with ID 8 must be sent while Keydnap isn’t running as root already When issued, the backdoor will start monitoring the user’s process count When two new processes are created within two seconds, Keydnap will spawn a window asking for the user’s credentials, exactly like the one OS X users usually see when an application requires admin privileges If the victim falls for this and enters their credentials, the backdoor will henceforth run as root and the content of the victim’s keychain will be exfiltrated Figure 12: Code performing the process count check Figure 13: icloudsyncd requesting privileges We do not know what the authd_service executable managed by command ID 9 is, because we haven’t seen it used It could be a third stage malware deployed to certain targets of interest Conclusion There are a few missing pieces to this puzzle We do not know at this point how Keydnap is distributed Nor do we know how many victims there are out there Although there are multiple security mechanisms in place in OS X to mitigate malware, it’s possible to deceive the user into executing non-sandboxed malicious code by replacing the icon of a Mach-O file IoCs Samples Downloader All downloaders listed below are detected as OSX/TrojanDownloader.Keydnap.A by ESET products Marc-Etienne M.Léveillé 6 Jul 2016 - 02:30PM ### Response: .