HackingTeam RCS implant analyzed for macOS

Patrick Wardle reverse-engineers a new HackingTeam RCS macOS implant installer that abuses Apple's native binary encryption and custom packing to evade AV detection.

This analysis from Objective-See dissects a previously unseen macOS implant installer attributed to HackingTeam's Remote Control System (RCS) surveillance suite. The dropper is notable for leveraging Apple's native FairPlay-style binary encryption (SG_PROTECTED_VERSION_1) combined with a custom packer, techniques the author had previously proposed as theoretical malware evasion methods in a 2015 BlackHat talk. At time of analysis, both the installer and the dropped persistent implant were detected by zero of 54 antivirus engines on VirusTotal.

The installer decrypts and unpacks itself in memory, then drops a persistent implant binary (_9g4cBUb.psr) and an encrypted configuration file (Bs-V7qIU.cYL) into a hidden preferences directory. The implant establishes persistence via a LaunchAgent plist (com.apple.FinderExtAvt.plist) and contains strings consistent with HackingTeam's RCS backdoor functionality, including screenshot capture, SLI (Startup Item) list manipulation, and backdoor control routines — indicating continued development of RCS capabilities for macOS surveillance despite the company's 2015 breach.

The author used memory-dumping techniques (via a custom injected suspension library and the readMem tool) to bypass the anti-debugging behavior of the packer, enabling static analysis in IDA Pro. The piece also serves as a demonstration for Objective-See's free tools (TaskExplorer, BlockBlock, KnockKnock), which can detect encrypted/packed binaries and unauthorized persistence, positioning them as effective against this type of threat where traditional AV failed.

Source reporting: https://objective-see.org/blog/blog_0x0D.html