HackingTeam RCS implant analyzed for macOS
Patrick Wardle reverse-engineers a new HackingTeam RCS macOS implant installer that abuses Apple's native binary encryption and custom packing to evade AV detection.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
This analysis from Objective-See dissects a previously unseen macOS implant installer attributed to HackingTeam's Remote Control System (RCS) surveillance suite. The dropper is notable for leveraging Apple's native FairPlay-style binary encryption (SG_PROTECTED_VERSION_1) combined with a custom packer, techniques the author had previously proposed as theoretical malware evasion methods in a 2015 BlackHat talk. At time of analysis, both the installer and the dropped persistent implant were detected by zero of 54 antivirus engines on VirusTotal.
The installer decrypts and unpacks itself in memory, then drops a persistent implant binary (_9g4cBUb.psr) and an encrypted configuration file (Bs-V7qIU.cYL) into a hidden preferences directory. The implant establishes persistence via a LaunchAgent plist (com.apple.FinderExtAvt.plist) and contains strings consistent with HackingTeam's RCS backdoor functionality, including screenshot capture, SLI (Startup Item) list manipulation, and backdoor control routines — indicating continued development of RCS capabilities for macOS surveillance despite the company's 2015 breach.
The author used memory-dumping techniques (via a custom injected suspension library and the readMem tool) to bypass the anti-debugging behavior of the packer, enabling static analysis in IDA Pro. The piece also serves as a demonstration for Objective-See's free tools (TaskExplorer, BlockBlock, KnockKnock), which can detect encrypted/packed binaries and unauthorized persistence, positioning them as effective against this type of threat where traditional AV failed.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x0D.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs