SysJoker macOS Backdoor Analyzed by Objective-See
Objective-See dissects the macOS variant of the cross-platform SysJoker backdoor, detailing its persistence, encrypted C2 resolution via Google Drive, and remote command execution.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Following Intezer's initial report on the cross-platform SysJoker backdoor (Linux, Windows, macOS), Objective-See published a deep-dive analysis of the macOS variant. The sample, disguised as a video file (types-config.ts) but actually a universal Mach-O binary supporting both Intel and Apple Silicon, uses an adhoc code signature to evade suspicion. On execution, it copies itself to ~/Library/MacOsServices/updateMacOs and installs a LaunchAgent (com.apple.update.plist) for persistence with RunAtLoad enabled.
The malware retrieves its C2 address by downloading a base64-encoded, XOR-encrypted string from a hosted Google Drive text file, decrypting it to resolve graphic-updater.com (23.254.131.176). It then beacons a system survey (username, OS, AV, IP) to the C2 endpoint https://graphic-updater.com/api/attach using a spoofed Safari user-agent. The backdoor supports two primary tasking commands: 'exec', which downloads, unzips, chmods, and executes a remote payload, and 'cmd', which runs arbitrary shell commands via popen and exfiltrates the output to the C2 server.
The researchers note the malware was first discovered targeting a Linux-based web server at an educational institution before Windows and macOS variants were identified. Objective-See demonstrated that their free tools (BlockBlock, LuLu, KnockKnock) detected the malware's persistence and C2 beaconing behavior without prior signature knowledge, underscoring behavioral detection value against this first-stage backdoor.
Mentioned in this report
Detection guidance
Suspicious Self-Copy to Library MacOsServices Directory
A behavioural hunt for the technique in general.
Process copying itself to ~/Library/MacOsServices/ with a name resembling macOS system binaries — masquerade of legitimacy. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Self-Copy to Library MacOsServices Directory
description: Detects a process copying or moving itself to ~/Library/MacOsServices/
directory, which mimics legitimate Apple library paths. Generalises on the distinctive
directory path pattern and self-copy behaviour, not specific filenames.
tags:
- attack.persistence
- attack.t1036.008
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains: /Library/MacOsServices/
Image|endswith:
- /bin/cp
- /bin/mv
filter_admin_scripts:
ParentImage|contains:
- /usr/libexec/
- /Applications/
condition: selection and not filter_admin_scripts
falsepositives:
- Administrative scripts or software deployment tools copying binaries to custom library
paths
level: medium
id: 001c6ff4-442f-5f80-b854-218cac19d823
status: experimental
author: Vorant
Shell Process Exfiltrating Output to Remote HTTPS Endpoint
A behavioural hunt for the technique in general.
Shell command spawned by non-shell parent, piping output to curl/wget beaconing to remote HTTPS with system survey data (user, OS, IP). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Process Exfiltrating Output to Remote HTTPS Endpoint
description: Detects a shell (sh/bash) spawned by a non-shell parent process executing
curl or wget to exfiltrate command output to a remote HTTPS endpoint. Typical backdoor
tasking response exfiltration. Generalises on the parent/child relation and piping
to curl/wget, not specific domains or IP addresses.
tags:
- attack.exfiltration
- attack.t1102.002
logsource:
category: process_creation
product: macos
detection:
selection_shell:
Image|endswith:
- /bin/sh
- /bin/bash
ParentImage|endswith:
- /bin/bash
CommandLine|contains:
- curl
- wget
selection_https:
CommandLine|contains:
- https://
- /api/
filter_legitimate_curl:
ParentImage|contains:
- /usr/libexec/
- /Applications/
condition: (selection_shell and selection_https) and not filter_legitimate_curl
falsepositives:
- Legitimate system administration scripts downloading or uploading files via curl
- Software installers or package managers using shell to fetch remote content
level: medium
id: ca9e411d-4608-577d-bb6c-d85bbabb5a2e
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x6C.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs