SysJoker macOS Backdoor Analyzed by Objective-See

Objective-See dissects the macOS variant of the cross-platform SysJoker backdoor, detailing its persistence, encrypted C2 resolution via Google Drive, and remote command execution.

Following Intezer's initial report on the cross-platform SysJoker backdoor (Linux, Windows, macOS), Objective-See published a deep-dive analysis of the macOS variant. The sample, disguised as a video file (types-config.ts) but actually a universal Mach-O binary supporting both Intel and Apple Silicon, uses an adhoc code signature to evade suspicion. On execution, it copies itself to ~/Library/MacOsServices/updateMacOs and installs a LaunchAgent (com.apple.update.plist) for persistence with RunAtLoad enabled.

The malware retrieves its C2 address by downloading a base64-encoded, XOR-encrypted string from a hosted Google Drive text file, decrypting it to resolve graphic-updater.com (23.254.131.176). It then beacons a system survey (username, OS, AV, IP) to the C2 endpoint https://graphic-updater.com/api/attach using a spoofed Safari user-agent. The backdoor supports two primary tasking commands: 'exec', which downloads, unzips, chmods, and executes a remote payload, and 'cmd', which runs arbitrary shell commands via popen and exfiltrates the output to the C2 server.

The researchers note the malware was first discovered targeting a Linux-based web server at an educational institution before Windows and macOS variants were identified. Objective-See demonstrated that their free tools (BlockBlock, LuLu, KnockKnock) detected the malware's persistence and C2 beaconing behavior without prior signature knowledge, underscoring behavioral detection value against this first-stage backdoor.

Source reporting: https://objective-see.org/blog/blog_0x6C.html