BlueNoroff: new Trojan attacking macOS users

We recently discovered a new variety of malicious loader that targets macOS, presumably linked to the BlueNoroff APT gang and its ongoing campaign known as RustBucket. The threat actor is known to attack financial organizations, particularly companies, whose activity is in any way related to cryptocurrency, as well as individuals who hold crypto assets or take an interest in the subject. Information about the new loader variant first appeared in an X (formerly Twitter) post.

Original X (formerly Twitter) post about the new loader

Earlier RustBucket versions spread its malicious payload via an app disguised as a PDF viewer. By contrast, this new variety was found inside a ZIP archive that contained a PDF file named, “Crypto-assets and their risks for financial stability”, with a thumbnail that showed a corresponding title page. The metadata preserved inside the ZIP archive suggests the app was created on October 21, 2023.

App structure

Document thumbnail

Exactly how the archive spread is unknown. The cybercriminals might have emailed it to targets as they did with past campaigns.

The app had a valid signature when it was discovered, but the certificate has since been revoked.

App signature details

Written in Swift and named “EdoneViewer”, the executable is a universal format file that contains versions for both Intel and Apple Silicon chips. Decryption of the XOR-encrypted payload is handled by the main function, CalculateExtameGCD. While the decryption process is running, the app puts out unrelated messages to the terminal to try and lull the analyst’s vigilance.

The decrypted payload has the AppleScript format:

AppleScript code executed after the payload is deciphered

The script assembles and runs the following shell command:

Shell command

Once assembled, the shell command goes through the following steps:

• Downloads a PDF file, save it at /Users/Shared/Crypto-assets and their risks for financial stability.pdf, and opens it. This is a benign file launched as a diversion.
  

  Title page of the PDF decoy

• Sends a POST request to the server and saves the response to a hidden file named “.pw” and located at /Users/Shared/.
• Grants permissions to the file and executes it with the C&C address as an argument.

The C&C server is hosted at hxxp://on-global[.]xyz, a domain name registered fairly recently, on October 20, 2023. We were unable to find any links between the domain and any other files or threats.

The .pw file is a Trojan we detected back in August. Like the loader, this is a universal format file:

Details of the .pw file

The file collects and sends the following system information to the C&C:

• Computer name
• OS version
• Time zone
• Device startup date
• OS installation date
• Current time
• List of running processes

The data is collected and forwarded in cycles every minute. The Trojan expects one of the following three commands in response:

After receiving a 0x0 command, the program saves data sent with the command to the shared file named “.pld” and located at /Users/Shared/, gives it the read/write/run permissions and executes it:

Code snippet that writes and runs the downloaded file

Unfortunately, we did not receive a single command from the server during our analysis, so we were unable to find out the content of the following attack stage. The Trojan can now be detected by most anti-malware solutions:

Details of the second download as posted on VirusTotal

Indicators of compromise

Files

Links