Mac Malware Impersonates The Unarchiver to Steal User Data
Summary
Researchers analyzed a malicious macOS disk image distributed through a spoofed Unarchiver site. Its Swift binary downloads scripts that collect user data and send it to an attacker-controlled server.
Key points
- A look-alike domain copied The Unarchiver’s website and offered a malicious disk image for download.
- The disk image and its CryptoTrade executable were unsigned or ad-hoc signed and went undetected by VirusTotal vendors at the time of analysis.
- Strings in the executable revealed a password prompt and a URL for downloading a second-stage archive.
- The archive contained shell scripts to collect documents, Keychain data, browser information, wallet extensions, and other files.
- The scripts gathered the victim’s public IP address, packaged collected data into a ZIP file, and sent it to a server.
- The article does not identify the malware’s author; Russian-language comments suggest familiarity with Russian.
Article Details
- Attack Vectors
- A look-alike website impersonating The Unarchiver offered a malicious disk image for download.
- The disk image contained a Swift binary named CryptoTrade that prompted users for their password and launched shell scripts to collect user information.
- The scripts gathered documents, keychain data, browser data, system information, wallet-extension data, and application data, then packaged stolen information into a ZIP file for exfiltration.
- Defensive Notes
- Do not assume a low sandbox score or lack of antivirus detections means a file is benign; the article notes possible compatibility issues with Hatching Triage's macOS 10.15 sandbox.
- Verify that application download domains are legitimate and that downloaded disk images are signed.
- Investigate shell scripts and network activity associated with suspicious application installers, including password prompts and outbound data transfers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cryptomac[.]dev | Malicious domain hosting the second-stage grabber.zip payload. |
| DOMAIN | tneunarchiver[.]com | Look-alike phishing domain used to impersonate The Unarchiver and distribute the malicious disk image. |
| IPV4 | 81[.]19[.]137[.]179 | Exfiltration server receiving the ZIP archive of stolen victim information. |
| SHA1 | 4932e7da6b21e1e37c507c42d40951ba53a83cf4 | SHA-1 hash of the malicious TheUnarchiver.dmg disk image. |
| URL | hxxp[:]//81[.]19[.]137[.]179/api/index[.]php | Exfiltration URL used by send.sh to upload stolen information. |
| URL | hxxps[:]//cryptomac[.]dev/download/grabber[.]zip | URL identified in the malware as the second-stage grabber.zip download. |
MITRE ATT&CK
T1005 · Data from Local SystemScripts collect local documents, keychain data, browser data, system information, wallet-extension data, and application data.T1041 · Exfiltration Over C2 Channelsend.sh uses curl to send the archive of stolen information to the exfiltration URL.T1056.002 · GUI Input CaptureThe malware prompts the user for a password as part of its installation process.T1560.001 · Archive via Utilitysend.sh packages stolen information into a ZIP archive before sending it.
People
Malware
Atomic macOS Stealer (AMOS)In this post, we analyzed a malicious disk image that appears to not yet be known to security vendors, but has similar traits to the growing number of stealers targeting MacOS users like Amos, Poseidon, etc.CryptoTradeLastly, if you are a user of The Unarchiver, you likely have realized that the legitimate binary is named after the software and not "CryptoTrade."PoseidonIn this post, we analyzed a malicious disk image that appears to not yet be known to security vendors, but has similar traits to the growing number of stealers targeting MacOS users like Amos, Poseidon, etc.
Vendors
Products
Hatching TriageDuring routine research on Hatching Triage, we discovered a submission for the domain tneunarchiver[.]com. This site, designed to mimic the legitimate theunarchiver[.]com, replicated the web page precisely, except formacOSThe "MacOS" folder contains the executable binary, which runs when users double-click the app icon, familiar to most as part of the installation process.The UnarchiverThe Unarchiver bills itself as "the top application for archives on Mac. It's a RAR extractor, it allows you to unzip files, and works with dozens of other formats."VirusTotalFigure 2: TheUnarchiver.dmg analysis results in Triage (Source: Hatching Triage)The file was also not detected as malicious by any of the security vendors in VirusTotal.
Tools
FLOSSWhen it comes to file analysis, you can't beat the Strings command or Floss. Quickly scanning through the text file output reveals a new domain and code likely used to capture a user's password.hdiutilNow that we're in a safe environment to dig deeper into the suspicious file, let's first figure out basic data like signing information and then manually mount the disk image using hdiutil.otoolotool -fv CryptoTradeWhatsYourSignFigure 4: Checking signature information for TheUnarchiver.dmg using Patrick Wardle's "WhatsYourSign" toolThe "WhatsYourSign" tool by Patrick Wardle unsurprisingly finds that the disk image is not signed.