OSX.WindTail.A

Once the target visits the malicious website, the website can automatically initiate the download of an archive (.zip) file that contains the malicious application... code within the malicious web page can load or ‘browse’ to the custom URL... macOS will look up the handler for this custom URL scheme... Once this lookup is completed, the OS will attempt to launch the malicious application.

In order to initiate the exploitation of their Mac targets, the WINDSHIFT APT group abused several methods including malicious emails. Such emails would either contain the malware directly as an attachment or contain a phishing link to a malicious site that would trigger the custom URL scheme exploit.

Such emails would either contain the malware directly as an attachment... In his presentation [1], Karim included the image shown in Figure 8, which illustrates a malicious WINDSHIFT email (that includes the malware as an attachment).

Such emails would either contain the malware directly as an attachment or contain a phishing link to a malicious site that would trigger the custom URL scheme exploit.

Although user interaction was required, it was minimal and could be ‘influenced’ by the attacker... Even today, if the user clicks ‘Allow’, macOS will launch the registered application... some will not – as was demonstrated by WINDSHIFT APT’s successful attacks.

After resolving the path to itself, the malware invokes the ‘LSSharedFileListInsertItemURL’ API. This adds a login item, which is a mechanism to gain persistence and ensure that the (malicious) application will automatically be (re)started every time the user logs in.

After resolving the path to itself, the malware invokes the ‘LSSharedFileListInsertItemURL’ API. This adds a login item, which is a mechanism to gain persistence and ensure that the (malicious) application will automatically be (re)started every time the user logs in.

Note that this malware (ab)uses Microsoft Office icons, probably to avoid raising suspicion... an attacker can leverage a homograph attack. This allows us to name the malicious application something like ‘Attachment.TXT’

If the request returns a string that equals ‘1’: Deletes itself Terminates itself... if the server returns a ‘1’ the malware will delete itself and then immediately terminate.

Recall that the malware invokes the ‘yoop’ method to decrypt embedded strings... one can observe the malware dynamically decrypting and decoding strings.

Steps 1-5 generate, and on subsequent executions (re)load, a unique identifier for the implant (e.g. 2012201800380925). Note: Such a ‘per-implant’ identifier helps a remote attacker keep track (or organize) infected hosts.

The malware then adds files that match the (previously) decrypted file extensions (doc, db, rtf, etc.) to an array... The ‘fist’ method... reveals the malware first enumerating and building a list of directories.

Steps 1-5 generate, and on subsequent executions (re)load, a unique identifier for the implant (e.g. 2012201800380925). Note: Such a ‘per-implant’ identifier helps a remote attacker keep track (or organize) infected hosts.

For each of the files that the ‘fist’ method added to the ‘honk’ array, the malware invokes a method, aptly named ‘zip’, and invokes macOS’s built-in zip utility to create an archive of the file.

the malware’s ‘mydel’ method appears to attempt to connect to the attacker’s C&C servers... the addresses of the C&C servers can be recovered... string2me.com... flux2key.com

A Wireshark capture also illustrates the exfiltration attempt to string2me.com... the malware invoking curl to exfiltrate files to its command-and-control server, string2me.com.

References to ‘curl’ (/usr/bin/curl) in this method illustrate that the malware is exfiltrating the files by (ab)using this built-in network utility... ‘-F’ flag will post data... This enables uploading of binary files etc.