# Pirated UltraEdit macOS app drops Khepri RAT

Published: 2024-01-15 · Severity: medium
Canonical: https://vorant.io/reports/7a63aa64-1c93-5159-961a-27a3ea86ab66/pirated-ultraedit-macos-app-drops-khepri-rat

> A trojanized pirated copy of UltraEdit for macOS installs a malicious dylib that downloads a Khepri post-exploitation agent and a persistent secondary downloader.

Objective-See analyzed a pirated macOS disk image for UltraEdit (originally flagged by MalwareHunterTeam and previously documented by Jamf Threat Labs) and found it bundles an unsigned dynamic library, libConfigurer64.dylib, injected as a dependency of the legitimate app. The library executes automatically via a Mach-O constructor when the app launches, then reaches out to download.ultraedit.info to fetch and XOR-decode two additional payloads: a macOS build of the open-source Khepri post-exploitation/C2 agent (saved to /tmp/.test) and a second downloader (saved to /Users/Shared/.fseventsd) that was undetected by all VirusTotal engines at time of analysis.

The .fseventsd component establishes persistence via a LaunchAgent (com.apple.fsevents.plist, RunAtLoad=true) and attempts to retrieve a further-stage payload from bd.ultraedit.vip/fs.log, though that server was offline during testing, leaving the final payload's purpose unconfirmed. Khepri itself, once executed, gives an attacker near-complete remote control of the infected host and communicates outward for tasking. The chain illustrates a multi-stage trojanized-software distribution model: initial AV detections exist for the disk image, app, and dylib, but the deeper downloaded stages evaded detection, underscoring reliance on behavioral/network monitoring (e.g., Objective-See's BlockBlock and LuLu) for coverage of pirated-software supply chains targeting macOS users.

## Mentioned in this report

- Malware: .fseventsd, Khepri, libConfigurer64.dylib

Source reporting: https://objective-see.org/blog/blog_0x79.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7a63aa64-1c93-5159-961a-27a3ea86ab66/pirated-ultraedit-macos-app-drops-khepri-rat.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup