Article Content During our continued research on Sofacy’s Komplex Trojan, we have found a sample of a backdoor Trojan that we believe the Sofacy group uses when targeting individuals running macOS systems The backdoor Trojan authors have called it XAgentOSX, which shares the name XAgent with one of Sofacy’s Windows-based Trojan and references Apple’s previous name for macOS, OS X The data structure used to transmit the agent_id to the C2 is as follows: struct { DWORD random_value_for_key; CHAR[7] constant_value; DWORD agent_id; } The constant value in the data structure is a 7 byte string that is hardcoded to “\x56\x0E\x9F\xF0\xEB\x98\x43”, followed by the agent_id value (“0000” in our case) The first DWORD in the data is a random value that the Trojan will use as an XOR key to encrypt the constant value and the agent_id The XAgentOSX Trojan includes responses to commands within HTML tags, which we believe allows the C2 server to format logs for viewing In most cases, the responses sent to the C2 server are included between the “<font size=4 color=000066><pre>” and “</pre></font>” HTML tags Uses the same method in “takeScreenShot” function   112 stopTakeScreenShot Closes the thread created in the “startTakeScreenShot” function   116 getFirefoxPassword Looks for folders with “/Firefox/Profiles” in the path and reads the contents of the “logins.json” file for “hostname”, “encryptedUsername” and “encryptedPassword” entries 118 ftpStop Calls “stopOperation” method, but does not appear to stop FTP uploads We believe this command is used to determine if a mobile device was backed up, and we speculate that the actors would use other commands within XAgent to exfiltrate those files XAgent logs key strokes by calling the CGEventTapCreate function to set an event hook to call a callback function named _myCGEventTapCallBack when it detects pressed keys We were also unable to find any additional infrastructure based on the primary C2 location of 23.227.196[.]215 However, according to CrowdStrike, the nearby IP address 23.227.196[.]217 hosted the C2 location for an XTunnel payload used by the Sofacy group in the attack on the Democratic National Committee While these IP addresses do not directly overlap, it does appear that the Sofacy group continues to use the same hosting services to host their infrastructure Conclusion The Sofacy group continues to bolster their toolset to carry out attack campaigns on multiple platforms In this case, the threat group uses the same name XAgent for this macOS-based tool as one of their Windows-based tools Also, the macOS variant of this tool uses a similar network communications method as its Windows counterpart, which suggests this group continues to use consolidated C2 services to control compromised hosts, as we saw during our comparison of the Komplex and Seduploader (formerly referred to as Sofacy Carberp) tools Also, while we lack attack telemetry, we were able to find a loose connection to the attack campaign that Sofacy waged on the Democratic National Committee based on hosting data in both attacks Palo Alto Networks customers are protected from XAgentOSX via:  Known samples are detected as malicious by WildFire All known C2 locations are marked as malicious in PANDB Users can use AutoFocus tag XAgent to track this threat  Indicators of Compromise SHA256 2a854997a44f4ba7e307d408ea2d9c1d84dde035c5dab830689aa45c5b5746ea Command and Control 23.227.196[.]215 apple-iclods[.]org apple-checker[.]org apple-uptoday[.]org apple-search[.]info
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content During our continued research on Sofacy’s Komplex Trojan, we have found a sample of a backdoor Trojan that we believe the Sofacy group uses when targeting individuals running macOS systems The backdoor Trojan authors have called it XAgentOSX, which shares the name XAgent with one of Sofacy’s Windows-based Trojan and references Apple’s previous name for macOS, OS X The data structure used to transmit the agent_id to the C2 is as follows: struct { DWORD random_value_for_key; CHAR[7] constant_value; DWORD agent_id; } The constant value in the data structure is a 7 byte string that is hardcoded to “\x56\x0E\x9F\xF0\xEB\x98\x43”, followed by the agent_id value (“0000” in our case) The first DWORD in the data is a random value that the Trojan will use as an XOR key to encrypt the constant value and the agent_id The XAgentOSX Trojan includes responses to commands within HTML tags, which we believe allows the C2 server to format logs for viewing In most cases, the responses sent to the C2 server are included between the “<font size=4 color=000066><pre>” and “</pre></font>” HTML tags Uses the same method in “takeScreenShot” function   112 stopTakeScreenShot Closes the thread created in the “startTakeScreenShot” function   116 getFirefoxPassword Looks for folders with “/Firefox/Profiles” in the path and reads the contents of the “logins.json” file for “hostname”, “encryptedUsername” and “encryptedPassword” entries 118 ftpStop Calls “stopOperation” method, but does not appear to stop FTP uploads We believe this command is used to determine if a mobile device was backed up, and we speculate that the actors would use other commands within XAgent to exfiltrate those files XAgent logs key strokes by calling the CGEventTapCreate function to set an event hook to call a callback function named _myCGEventTapCallBack when it detects pressed keys We were also unable to find any additional infrastructure based on the primary C2 location of 23.227.196[.]215 However, according to CrowdStrike, the nearby IP address 23.227.196[.]217 hosted the C2 location for an XTunnel payload used by the Sofacy group in the attack on the Democratic National Committee While these IP addresses do not directly overlap, it does appear that the Sofacy group continues to use the same hosting services to host their infrastructure Conclusion The Sofacy group continues to bolster their toolset to carry out attack campaigns on multiple platforms In this case, the threat group uses the same name XAgent for this macOS-based tool as one of their Windows-based tools Also, the macOS variant of this tool uses a similar network communications method as its Windows counterpart, which suggests this group continues to use consolidated C2 services to control compromised hosts, as we saw during our comparison of the Komplex and Seduploader (formerly referred to as Sofacy Carberp) tools Also, while we lack attack telemetry, we were able to find a loose connection to the attack campaign that Sofacy waged on the Democratic National Committee based on hosting data in both attacks Palo Alto Networks customers are protected from XAgentOSX via:  Known samples are detected as malicious by WildFire All known C2 locations are marked as malicious in PANDB Users can use AutoFocus tag XAgent to track this threat  Indicators of Compromise SHA256 2a854997a44f4ba7e307d408ea2d9c1d84dde035c5dab830689aa45c5b5746ea Command and Control 23.227.196[.]215 apple-iclods[.]org apple-checker[.]org apple-uptoday[.]org apple-search[.]info ### Response: .