Thread by @ESETresearch

#ESETresearch A year ago, a signed Mach-O executable disguised as a job description was uploaded to VirusTotal from Singapore 🇸🇬. Malware is compiled for Intel and Apple Silicon and drops a PDF decoy. We think it was part of #Lazarus campaign for Mac. @pkalnai @marc_etienne_ 1/8

The document, named BitazuCapital_JobDescription.pdf, reminds a strong similarity with a lure from Lazarus attacks using 2 TOY GUYS code-signing certificates for Windows, targeting aerospace and defense industries. welivesecurity.com/wp-content/upl… 2/8

Both decoys are PDF v1.5 documents produced by Microsoft Word 2016. They are obviously not identical, as one uses Colonna MT font while the other uses Calibri, but the title and ornaments on the front page have the same colors (#569bd5 and #aacc5db). 3/8

The dropper is signed using a certificate issued late Match 2021 to an organization presumably named Golden Book using the Apple ID goldenbook2021@icloud[.]com. Apple has revoked this certificate on 2021-11-10 22:40:00. 4/8

It unzips 2 malicious executables into the /Users/$USER/Library/Fonts folder, FinderFontsUpdater.app and safarifontsagent. The first simply executes the latter. 5/8

The second executable, safarifontagent, is downloader that fetches the next stage from remote location (https://onlinestockwatch[.]net/%user%.jpg) and drops it into /Users/%user%/Library/Fonts/Finder folder. The C&C server did not respond at the time we analyzed this threat. 6/8

IoCs:
55571AC52E1F02F18AF77E2F3314382C982A37744B58732DFC15FAAC9D66619F(Extractor)

A0BF5AF3F931A428B905FD14D43B61AF47B7F272425AE4FF4D78B5CB139B8276 (FinderFontsUpdater)

315503862CB7EBB0A731483827016015E355BAD51F872DB5C650A822DE744937 (safarifontagent) 7/8

IoCs:
onlinestockwatch[.]net

OSX/NukeSped.N

#ESETresearch 8/8