OSX.Mokes.B backdoor hits crypto exchange staff

A new Mokes malware variant, dropped alongside OSX.Netwire via a Firefox zero-day, backdoored Mac systems at cryptocurrency exchanges and evaded all AV engines.

Objective-See researchers analyzed a second macOS malware sample used in a campaign that leveraged a Firefox zero-day to target employees at cryptocurrency exchanges. The first payload, OSX.Netwire.A, was covered in earlier posts; this article details the second payload, an unsigned 13MB Mach-O binary that was undetected by every AV engine on VirusTotal at time of submission. Static and dynamic analysis revealed the malware installs itself under randomized names (e.g., quicklookd, storeaccountd) into locations like ~/Library/Dropbox/, persists via a LaunchAgent plist with RunAtLoad, and beacons out to a hardcoded C2 IP (185.49.69.210).

The analyst, cross-referencing strings, embedded Objective-C classes, and file-search/exfiltration constants, determined the sample shares extensive code and behavioral overlap with OSX.Mokes, a cross-platform backdoor first documented by Kaspersky in 2016. Shared traits include identical file-search constants for Office documents, matching temporary file naming conventions for screenshots/audio/keylogs/data (.sst/.aat/.kkt/.ddt), AVFoundation-based webcam/audio capture capability, and similar installation naming pairs. Based on this, the researcher designates the new sample OSX.Mokes.B, a variant of the original Mokes backdoor rather than a wholly new family.

The piece emphasizes that despite close lineage to a well-documented 2016 backdoor, the new variant evaded all VirusTotal AV signatures, reinforcing the value of behavior-based detection tools (KnockKnock, BlockBlock, LuLu, OverSight) that can generically flag persistence, C2 communication, and audio/video capture without prior signature knowledge.

title: macOS Malware Persistence via LaunchAgent with RunAtLoad
description: Detects LaunchAgent plist creation with RunAtLoad key in ~/Library/LaunchAgents
  pointing to executable paths in user-writable Library subdirectories (Dropbox, Caches,
  etc.) - indicative of backdoor persistence. Generalises on the plist location, RunAtLoad
  key presence, and suspicious executable path pattern rather than specific filenames.
tags:
- attack.persistence
- attack.t1547.001
logsource:
  category: file_event
  product: macos
detection:
  selection_plist_location:
    TargetFilename|contains:
    - /Library/LaunchAgents/
    TargetFilename|endswith: .plist
  selection_plist_content:
    EventType: Created
  selection_suspicious_paths:
    TargetFilename|contains:
    - /Library/Dropbox/
    - /Library/Caches/
    - /Library/Application Support/
  filter_known_legitimate:
    TargetFilename|contains:
    - /Library/LaunchAgents/com.apple.
    - /Library/LaunchAgents/com.google.
  condition: selection_plist_location and selection_plist_content and selection_suspicious_paths
    and not filter_known_legitimate
falsepositives:
- Third-party application installers legitimately placing LaunchAgents in user Library
- Cloud sync clients (Dropbox, OneDrive, iCloud) managing their own persistence
level: high
id: 81b742d6-b133-58f9-ab23-350b28ee0fb9
status: experimental
author: Vorant

title: Suspicious Binary Execution with Randomized System Daemon Names
description: Detects process execution where the binary name mimics legitimate macOS
  system daemons (quicklookd, storeaccountd, etc.) but originates from user-writable
  Library paths rather than /System or /usr/libexec. Flags name spoofing for evasion
  without requiring knowledge of the specific malware hash or campaign.
tags:
- attack.defense-evasion
- attack.t1036.005
logsource:
  category: process_creation
  product: macos
detection:
  selection_daemon_names:
    Image|contains:
    - quicklookd
    - storeaccountd
  selection_suspicious_path:
    Image|contains:
    - /Library/Dropbox/
    - /Library/Caches/
    - /Library/Application Support/
  filter_system_paths:
    Image|startswith:
    - /System/
    - /usr/libexec/
    - /Library/Apple/
  condition: selection_daemon_names and selection_suspicious_path and not filter_system_paths
falsepositives:
- Custom or developer builds of system tools placed in user directories for testing
- Legitimate third-party tools that bundle macOS binaries with matching names
level: high
id: 91d57b6f-ae95-5545-ac47-d16c1bc9dd5b
status: experimental
author: Vorant

title: Unsigned Mach-O Binary with Audio/Video Capture Framework Loading
description: Detects unsigned Mach-O binaries executed from user Library directories
  that load AVFoundation (audio/video capture) and create temporary files matching
  known backdoor capture naming patterns (.sst for screenshots, .aat for audio, .kkt
  for keylogs, .ddt for exfil data). Generalises on the framework loading and temp
  file pattern rather than binary hash or hardcoded C2 IP.
tags:
- attack.collection
- attack.t1113
logsource:
  category: process_creation
  product: macos
detection:
  selection_unsigned_binary:
    Image|contains:
    - /Library/Dropbox/
    - /Library/Caches/
    - /Library/Application Support/
    SignatureStatus: unsigned
  selection_avfoundation:
    ImageLoaded|contains: AVFoundation
  filter_legitimate_apps:
    Image|contains:
    - /Applications/
    - /usr/local/bin/
  condition: selection_unsigned_binary and selection_avfoundation and not filter_legitimate_apps
falsepositives:
- Developer tools or custom multimedia applications in user Library with unsigned
  builds
- Open-source media capture tools built locally without codesign
level: medium
id: bb95a76b-7ea0-5a49-9faa-ddf19b8a68ba
status: experimental
author: Vorant

Source reporting: https://objective-see.org/blog/blog_0x45.html