NetWire RAT Deployed via Firefox 0day
Attackers used a Firefox zero-day to install the OSX.NetWire.A backdoor on macOS systems of cryptocurrency exchange employees.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Objective-See published a technical deep-dive into OSX.NetWire.A, a macOS backdoor delivered via a Firefox zero-day exploit targeting employees at cryptocurrency exchanges. The malware, a 32-bit non-Objective-C binary compatible back to OSX 10.5, persists via a LaunchAgent (com.mac.host.plist) and a login item, copying itself to ~/.defaults/Finder.app. It decrypts embedded configuration data at runtime revealing a hardcoded C2 address (89.34.111.113:443) and stores host survey data in an encrypted .settings.conf file.
The analysis details the malware's command-and-control protocol, where a single byte received from the C2 server selects from a large switch table of supported actions including system reconnaissance, file operations (rename, delete, read/write), process listing/killing, arbitrary shell command execution via fork/execv, screen capture, synthetic keyboard/mouse event injection, and self-uninstallation. These capabilities give a remote operator effectively full control over an infected macOS host.
The report is a companion piece to an earlier post identifying the malware family and persistence mechanisms; this post focuses on reverse-engineering the binary using Hopper and lldb to recover decrypted strings, the C2 address, and full remote tasking capabilities. At time of analysis the C2 server was offline. No specific threat actor attribution is made by the author.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x44.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs