Pirated UltraEdit macOS app drops Khepri RAT

A trojanized pirated copy of UltraEdit for macOS installs a malicious dylib that downloads a Khepri post-exploitation agent and a persistent secondary downloader.

Objective-See analyzed a pirated macOS disk image for UltraEdit (originally flagged by MalwareHunterTeam and previously documented by Jamf Threat Labs) and found it bundles an unsigned dynamic library, libConfigurer64.dylib, injected as a dependency of the legitimate app. The library executes automatically via a Mach-O constructor when the app launches, then reaches out to download.ultraedit.info to fetch and XOR-decode two additional payloads: a macOS build of the open-source Khepri post-exploitation/C2 agent (saved to /tmp/.test) and a second downloader (saved to /Users/Shared/.fseventsd) that was undetected by all VirusTotal engines at time of analysis.

The .fseventsd component establishes persistence via a LaunchAgent (com.apple.fsevents.plist, RunAtLoad=true) and attempts to retrieve a further-stage payload from bd.ultraedit.vip/fs.log, though that server was offline during testing, leaving the final payload's purpose unconfirmed. Khepri itself, once executed, gives an attacker near-complete remote control of the infected host and communicates outward for tasking. The chain illustrates a multi-stage trojanized-software distribution model: initial AV detections exist for the disk image, app, and dylib, but the deeper downloaded stages evaded detection, underscoring reliance on behavioral/network monitoring (e.g., Objective-See's BlockBlock and LuLu) for coverage of pirated-software supply chains targeting macOS users.

title: Mach-O Binary Loading Unsigned Dylib from App Bundle
description: Detects when a legitimate macOS application (e.g., UltraEdit, text editors)
  loads a dynamic library from within its own bundle directory. This is characteristic
  of trojanized software where an attacker injects a malicious dylib as a dependency,
  which executes via Mach-O constructor during normal app launch. The rule focuses
  on the parent-child relationship and the loading pattern rather than specific file
  names or hashes.
tags:
- attack.persistence
- attack.t1554
- attack.t1027
logsource:
  category: image_load
  product: macos
detection:
  selection:
    Image|endswith:
    - /UltraEdit
    - /UltraEdit.app/Contents/MacOS/UltraEdit
    LoadedImage|contains: .app/Contents
    LoadedImage|endswith: .dylib
  filter_apple_system:
    LoadedImage|startswith:
    - /System/Library
    - /usr/lib
    - /Library/Apple
  condition: selection and not filter_apple_system
falsepositives:
- Legitimate application updates or add-ons that ship bundled dylibs
- Development builds with framework dependencies inside bundle
level: high
id: 8aa0a4a0-1832-51df-94a7-90232959f012
status: experimental
author: Vorant

title: LaunchAgent Persistence from Shared or Hidden Directory
description: Detects LaunchAgent property list files written to /Users/Shared or hidden
  directories (.*) with RunAtLoad set to true. This is characteristic of second-stage
  malware establishing persistence via a non-user-specific location, as seen in Khepri
  RAT chains. Legitimate admin tools occasionally use /Users/Shared, but the combination
  of hidden directory naming and RunAtLoad=true is rare and suspicious.
tags:
- attack.persistence
- attack.t1543.001
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains: \.
    TargetFilename|endswith: .plist
  file_content_runload:
    Content|contains: 'true'
  filter_legitimate_admin:
    TargetFilename|contains:
    - MDM
    - Jamf
    - Intune
  condition: (selection or file_content_runload) and not filter_legitimate_admin
falsepositives:
- Enterprise MDM or device management software deploying shared LaunchAgents
- System administration scripts provisioning multi-user shared launch daemons
level: high
id: 46d26b18-8373-5c47-a946-5551a2115593
status: experimental
author: Vorant

Source reporting: https://objective-see.org/blog/blog_0x79.html