Pirated UltraEdit macOS app drops Khepri RAT

A trojanized pirated copy of UltraEdit for macOS installs a malicious dylib that downloads a Khepri post-exploitation agent and a persistent secondary downloader.

Objective-See analyzed a pirated macOS disk image for UltraEdit (originally flagged by MalwareHunterTeam and previously documented by Jamf Threat Labs) and found it bundles an unsigned dynamic library, libConfigurer64.dylib, injected as a dependency of the legitimate app. The library executes automatically via a Mach-O constructor when the app launches, then reaches out to download.ultraedit.info to fetch and XOR-decode two additional payloads: a macOS build of the open-source Khepri post-exploitation/C2 agent (saved to /tmp/.test) and a second downloader (saved to /Users/Shared/.fseventsd) that was undetected by all VirusTotal engines at time of analysis.

The .fseventsd component establishes persistence via a LaunchAgent (com.apple.fsevents.plist, RunAtLoad=true) and attempts to retrieve a further-stage payload from bd.ultraedit.vip/fs.log, though that server was offline during testing, leaving the final payload's purpose unconfirmed. Khepri itself, once executed, gives an attacker near-complete remote control of the infected host and communicates outward for tasking. The chain illustrates a multi-stage trojanized-software distribution model: initial AV detections exist for the disk image, app, and dylib, but the deeper downloaded stages evaded detection, underscoring reliance on behavioral/network monitoring (e.g., Objective-See's BlockBlock and LuLu) for coverage of pirated-software supply chains targeting macOS users.

Source reporting: https://objective-see.org/blog/blog_0x79.html