Article Content We identified a MacOS backdoor (detected by Trend Micro as  OSX_OCEANLOTUS.D) that we believe is the latest version of a threat used by OceanLotus (a.k.a APT 32, APT-C-00, SeaLotus, and Cobalt Kitty) OceanLotus was responsible for launching targeted attacks against human rights organizations, media organizations, research institutes, and maritime construction firms The attackers behind OSX_OCEANLOTUS.D target MacOS computers which have the Perl programming language installed The MacOS backdoor was found in a malicious Word document presumably distributed via email The document bears the filename “2018-PHIẾU  GHI  DANH  THAM  DỰ  TĨNH  HỘI HMDC 2018.doc,” which translates to “2018-REGISTRATION FORM OF HMDC ASSEMBLY 2018.doc.” The document claims to be a registration form for an event with HDMC, an organization in Vietnam that advertises national independence and democracy Figure 1 Graphic used by the malicious document Upon receiving the malicious document, the user is advised to enable macros This is shown in the figure below Figure 2 It extracts theme0.xml file from the Word document theme0.xml is a Mach-O 32-bit executable with a  0xFEEDFACE signature that is also the dropper of the backdoor, which is the final payload theme0.xml is extracted to /tmp/system/word/theme/syslogd before it’s executed Figure 3. Deobfuscated Perl payload from the delivery document Dropper analysis The dropper is used to install the backdoor into the infected system and establish its persistence Figure 4 Figure 5 Hardcoded RSA256 key showing the first 20 characters Using the setStartup() method, the dropper first checks if it is running as a root or not Based on that, the GET_PROCESSPATH and GET_PROCESSNAME methods will decrypt the hardcoded path and filename where the backdoor should be installed Figure 6 The access permissions will then be changed to 0x1ed = 755, which is equal to u=rwx,go=rx Figure 7 This persistence file is also set to hidden with a randomly generated file date and time Figure 8 Meanwhile, runHandle is responsible for the backdoor capabilities Figure 9. The main functions of the backdoor infoClient fills up the variables in HandlePP class Figure 10. List of variables belonging to the HandlePP class clientID is an MD5 hash derived from the environment variables, while strClientID is a hexadecimal representation of clientID System Administrator <owner’s name>’s iMac x86_64  All these data are scrambled and encrypted before sending to the C&C server.  The process is detailed below:  Scrambling  Class Parser has several methods, one for each variable type – Parser::inBytes, Parser::inByte, Parser::inString, and Parser::inInt Figure 16. Parser::inBytes method If clientID equals the following sequence of bytes B4 B1 47 BC 52 28 28 73 1F 1A 01 6B FA 72 C0 73, then the scrambled version is computed using the third parameter (0x10), which is treated as a DWORD Each quadruple of bytes is XOR-ed with it, as shown in example below Figure 17. Parser::inByte method When scrambling one byte, the scrambler first determines if the byte value is odd or even If the value is odd, it adds the byte, along with one more randomly generated byte, to the array In the case of an even value, the randomly generated byte is added first, followed by the byte being added In the case above, the third parameter is ‘1’ = 0x31, which is an odd number This means that it adds byte ‘1’ and one randomly generated byte to the final scrambled array Figure 18. Parser::inString method When scrambling a string, the scrambler generates a 5-byte long sequence First, it generates one random byte, followed by three zero bytes, one random byte, and finally, the byte with the length of the string Let’s say we want to scramble string ‘Mac OSX 10.12.’ Its length is 13 = 0x0d, and the two random bytes are 0xf3 and 0x92.  The final 5-byte sequence looks like F3 00 00 00 92 0D The original string is then XOR’ed with the 5-byte sequence However, this key is also scrambled with operation XOR 0x13 followed by ROL 6 operation applied to each byte Figure 20 The scrambled AES256 key is marked green, while the encrypted computer info is marked red Other bytes are just randomly generated noise When the backdoor receives the response from the C&C server, the final payload needs to be decoded again in a similar manner via decryption and scrambling The received data from the C&C server include the following information:  HandlePP::urlRequest (/appleauth/static/cssj/N252394295/widget/auth/app.css) HandlePP::keyDecrypt STRINGDATA::BROWSER_SESSION_ID (m_pixel_ratio) STRINGDATA::RESOURCE_ID  These data will be later used in the C&C communication, as shown in the Wireshark screenshot below Supported commands and their respective codes Mitigation Malicious attacks targeting Mac devices are not as common as its counterparts, but the discovery of this new MacOS backdoor that is presumably distributed via phishing email calls for every user to adopt best practices for phishing attacks regardless of operating system 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content We identified a MacOS backdoor (detected by Trend Micro as  OSX_OCEANLOTUS.D) that we believe is the latest version of a threat used by OceanLotus (a.k.a APT 32, APT-C-00, SeaLotus, and Cobalt Kitty) OceanLotus was responsible for launching targeted attacks against human rights organizations, media organizations, research institutes, and maritime construction firms The attackers behind OSX_OCEANLOTUS.D target MacOS computers which have the Perl programming language installed The MacOS backdoor was found in a malicious Word document presumably distributed via email The document bears the filename “2018-PHIẾU  GHI  DANH  THAM  DỰ  TĨNH  HỘI HMDC 2018.doc,” which translates to “2018-REGISTRATION FORM OF HMDC ASSEMBLY 2018.doc.” The document claims to be a registration form for an event with HDMC, an organization in Vietnam that advertises national independence and democracy Figure 1 Graphic used by the malicious document Upon receiving the malicious document, the user is advised to enable macros This is shown in the figure below Figure 2 It extracts theme0.xml file from the Word document theme0.xml is a Mach-O 32-bit executable with a  0xFEEDFACE signature that is also the dropper of the backdoor, which is the final payload theme0.xml is extracted to /tmp/system/word/theme/syslogd before it’s executed Figure 3. Deobfuscated Perl payload from the delivery document Dropper analysis The dropper is used to install the backdoor into the infected system and establish its persistence Figure 4 Figure 5 Hardcoded RSA256 key showing the first 20 characters Using the setStartup() method, the dropper first checks if it is running as a root or not Based on that, the GET_PROCESSPATH and GET_PROCESSNAME methods will decrypt the hardcoded path and filename where the backdoor should be installed Figure 6 The access permissions will then be changed to 0x1ed = 755, which is equal to u=rwx,go=rx Figure 7 This persistence file is also set to hidden with a randomly generated file date and time Figure 8 Meanwhile, runHandle is responsible for the backdoor capabilities Figure 9. The main functions of the backdoor infoClient fills up the variables in HandlePP class Figure 10. List of variables belonging to the HandlePP class clientID is an MD5 hash derived from the environment variables, while strClientID is a hexadecimal representation of clientID System Administrator <owner’s name>’s iMac x86_64  All these data are scrambled and encrypted before sending to the C&C server.  The process is detailed below:  Scrambling  Class Parser has several methods, one for each variable type – Parser::inBytes, Parser::inByte, Parser::inString, and Parser::inInt Figure 16. Parser::inBytes method If clientID equals the following sequence of bytes B4 B1 47 BC 52 28 28 73 1F 1A 01 6B FA 72 C0 73, then the scrambled version is computed using the third parameter (0x10), which is treated as a DWORD Each quadruple of bytes is XOR-ed with it, as shown in example below Figure 17. Parser::inByte method When scrambling one byte, the scrambler first determines if the byte value is odd or even If the value is odd, it adds the byte, along with one more randomly generated byte, to the array In the case of an even value, the randomly generated byte is added first, followed by the byte being added In the case above, the third parameter is ‘1’ = 0x31, which is an odd number This means that it adds byte ‘1’ and one randomly generated byte to the final scrambled array Figure 18. Parser::inString method When scrambling a string, the scrambler generates a 5-byte long sequence First, it generates one random byte, followed by three zero bytes, one random byte, and finally, the byte with the length of the string Let’s say we want to scramble string ‘Mac OSX 10.12.’ Its length is 13 = 0x0d, and the two random bytes are 0xf3 and 0x92.  The final 5-byte sequence looks like F3 00 00 00 92 0D The original string is then XOR’ed with the 5-byte sequence However, this key is also scrambled with operation XOR 0x13 followed by ROL 6 operation applied to each byte Figure 20 The scrambled AES256 key is marked green, while the encrypted computer info is marked red Other bytes are just randomly generated noise When the backdoor receives the response from the C&C server, the final payload needs to be decoded again in a similar manner via decryption and scrambling The received data from the C&C server include the following information:  HandlePP::urlRequest (/appleauth/static/cssj/N252394295/widget/auth/app.css) HandlePP::keyDecrypt STRINGDATA::BROWSER_SESSION_ID (m_pixel_ratio) STRINGDATA::RESOURCE_ID  These data will be later used in the C&C communication, as shown in the Wireshark screenshot below Supported commands and their respective codes Mitigation Malicious attacks targeting Mac devices are not as common as its counterparts, but the discovery of this new MacOS backdoor that is presumably distributed via phishing email calls for every user to adopt best practices for phishing attacks regardless of operating system  ### Response: .