NetWire RAT Deployed via Firefox 0day

Attackers used a Firefox zero-day to install the OSX.NetWire.A backdoor on macOS systems of cryptocurrency exchange employees.

Objective-See published a technical deep-dive into OSX.NetWire.A, a macOS backdoor delivered via a Firefox zero-day exploit targeting employees at cryptocurrency exchanges. The malware, a 32-bit non-Objective-C binary compatible back to OSX 10.5, persists via a LaunchAgent (com.mac.host.plist) and a login item, copying itself to ~/.defaults/Finder.app. It decrypts embedded configuration data at runtime revealing a hardcoded C2 address (89.34.111.113:443) and stores host survey data in an encrypted .settings.conf file.

The analysis details the malware's command-and-control protocol, where a single byte received from the C2 server selects from a large switch table of supported actions including system reconnaissance, file operations (rename, delete, read/write), process listing/killing, arbitrary shell command execution via fork/execv, screen capture, synthetic keyboard/mouse event injection, and self-uninstallation. These capabilities give a remote operator effectively full control over an infected macOS host.

The report is a companion piece to an earlier post identifying the malware family and persistence mechanisms; this post focuses on reverse-engineering the binary using Hopper and lldb to recover decrypted strings, the C2 address, and full remote tasking capabilities. At time of analysis the C2 server was offline. No specific threat actor attribution is made by the author.

Source reporting: https://objective-see.org/blog/blog_0x44.html