OSX.Mokes.B backdoor hits crypto exchange staff
A new Mokes malware variant, dropped alongside OSX.Netwire via a Firefox zero-day, backdoored Mac systems at cryptocurrency exchanges and evaded all AV engines.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Objective-See researchers analyzed a second macOS malware sample used in a campaign that leveraged a Firefox zero-day to target employees at cryptocurrency exchanges. The first payload, OSX.Netwire.A, was covered in earlier posts; this article details the second payload, an unsigned 13MB Mach-O binary that was undetected by every AV engine on VirusTotal at time of submission. Static and dynamic analysis revealed the malware installs itself under randomized names (e.g., quicklookd, storeaccountd) into locations like ~/Library/Dropbox/, persists via a LaunchAgent plist with RunAtLoad, and beacons out to a hardcoded C2 IP (185.49.69.210).
The analyst, cross-referencing strings, embedded Objective-C classes, and file-search/exfiltration constants, determined the sample shares extensive code and behavioral overlap with OSX.Mokes, a cross-platform backdoor first documented by Kaspersky in 2016. Shared traits include identical file-search constants for Office documents, matching temporary file naming conventions for screenshots/audio/keylogs/data (.sst/.aat/.kkt/.ddt), AVFoundation-based webcam/audio capture capability, and similar installation naming pairs. Based on this, the researcher designates the new sample OSX.Mokes.B, a variant of the original Mokes backdoor rather than a wholly new family.
The piece emphasizes that despite close lineage to a well-documented 2016 backdoor, the new variant evaded all VirusTotal AV signatures, reinforcing the value of behavior-based detection tools (KnockKnock, BlockBlock, LuLu, OverSight) that can generically flag persistence, C2 communication, and audio/video capture without prior signature knowledge.
Mentioned in this report
Detection guidance
Suspicious Binary Execution with Randomized System Daemon Names
A behavioural hunt for the technique in general.
Detects execution of binaries with spoofed macOS system daemon names (e.g., quicklookd, storeaccountd) from non-standard paths like ~/Library/Dropbox - name masquerading for evasion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Binary Execution with Randomized System Daemon Names
description: Detects process execution where the binary name mimics legitimate macOS
system daemons (quicklookd, storeaccountd, etc.) but originates from user-writable
Library paths rather than /System or /usr/libexec. Flags name spoofing for evasion
without requiring knowledge of the specific malware hash or campaign.
tags:
- attack.stealth
- attack.t1036.005
logsource:
category: process_creation
product: macos
detection:
selection_daemon_names:
Image|contains:
- quicklookd
- storeaccountd
selection_suspicious_path:
Image|contains:
- /Library/Dropbox/
- /Library/Caches/
- /Library/Application Support/
filter_system_paths:
Image|startswith:
- /System/
- /usr/libexec/
- /Library/Apple/
condition: selection_daemon_names and selection_suspicious_path and not filter_system_paths
falsepositives:
- Custom or developer builds of system tools placed in user directories for testing
- Legitimate third-party tools that bundle macOS binaries with matching names
level: high
id: 91d57b6f-ae95-5545-ac47-d16c1bc9dd5b
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x45.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs