CrashStealer
Thijs Xhaflaire (via Ric Ford):
Jamf Threat Labs discovers and investigates CrashStealer, a C++ macOS infostealer that impersonates Apple's crash-reporting framework to harvest browser credentials, cryptocurrency wallets and keychain data, encrypting stolen files with AES-GCM before exfiltrating them to a remote command-and-control server.
[…]
Unlike the payload it eventually installs, the dropper is properly code signed and notarized: it is a universal (arm64 and x86_64) binary signed with the Developer ID
Emil Grigorov (WWB7JA7AQV), has hardened runtime enabled, and carries a stapled notarization ticket. Notably, the disk image itself is signed as well, not just the application inside it, which is uncommon in malicious DMG delivery where the container is typically left unsigned.[…]
That file supplies the
curlcommand the dropper runs next. Staging the first hop on a trusted developer domain keeps the initial network activity inconspicuous.[…]
[The script] clears extended attributes on the staged bundle with
xattr -cr, makes the inner binary executable, strips the payload's existing signature and re-signs it ad-hoc (codesign --remove-signaturefollowed bycodesign -s - --force --deep --no-strict), registers it with Launch Services vialsregister -f, and finally launches it in the background withopen -g -n.
Previously:
- Notarized Mac App That Downloads Malware
- Fake Mac Apps on GitHub
- Notarized Atomic Stealer (AMOS)
- More Notarized Mac Malware
- App Transport Security
