Researcher repurposes Lazarus macOS loader
A researcher reverse-engineered Lazarus Group's fileless macOS loader (OSX.AppleJeus.C/unioncryptoupdater) and showed how to hijack it to execute arbitrary in-memory payloads.
Objective-See's Patrick Wardle revisits a Lazarus Group macOS implant (internally 'macloader', tracked as OSX.AppleJeus.C, binary name unioncryptoupdater) previously analyzed for its fileless, in-memory payload execution capability. The malware persists via a LaunchDaemon and beacons to a hardcoded C2 (unioncrypto.vip) requesting second-stage payloads that are base64-decoded, AES-CBC decrypted (key derived from an MD5 hash of the victim's serial number), and loaded directly into memory via mmap and Apple's NSCreateObjectFileImageFromMemory/NSLinkModule APIs—code the author notes was lifted almost verbatim from Cylance's 2017 open-source 'osx_runbin' project.
Having fully reverse-engineered the C2 protocol, encryption scheme, and payload format, the author built a custom Python C2 server to emulate the expected responses, then patched the malware's binary to point to an attacker-controlled server and payload location. This allowed a benign 'Hello World' Mach-O binary to be encrypted, encoded, and successfully executed in memory on an infected test system, demonstrating that Lazarus's loader can be trivially repurposed by third parties to deliver arbitrary code while masquerading as Lazarus activity—complicating attribution and forensics.
The piece is primarily a technical/research writeup illustrating malware repurposing and macOS in-memory execution detection challenges (via Apple's Endpoint Security Framework, e.g., ES_EVENT_TYPE_NOTIFY_MMAP), rather than reporting a new active campaign. It reinforces that Lazarus continues to develop and deploy fileless macOS tooling, and highlights the difficulty of memory forensics on macOS given kernel extension deprecation.
Mentioned in this report
Detection guidance
Reflective Code Loading via Apple Memory Mapping APIs
Detects process calling NSCreateObjectFileImageFromMemory and NSLinkModule APIs to load executable code directly into memory without disk persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflective Code Loading via Apple Memory Mapping APIs
description: "Detects calls to NSCreateObjectFileImageFromMemory and NSLinkModule,\
\ which enable in-memory Mach-O binary execution\u2014fileless payload delivery\
\ technique used by Lazarus and others on macOS."
tags:
- attack.defense-evasion
- attack.t1620
logsource:
category: image_load
product: macos
detection:
selection:
ImageLoaded|contains:
- Foundation.framework
APIs|contains:
- NSCreateObjectFileImageFromMemory
- NSLinkModule
condition: selection
falsepositives:
- Legitimate macOS development tools and frameworks using dynamic code loading
level: medium
id: 30b98590-8f8a-5317-9899-17873cae58e7
status: experimental
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x54.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free