SysJoker macOS Backdoor Analyzed by Objective-See

Objective-See dissects the macOS variant of the cross-platform SysJoker backdoor, detailing its persistence, encrypted C2 resolution via Google Drive, and remote command execution.

Following Intezer's initial report on the cross-platform SysJoker backdoor (Linux, Windows, macOS), Objective-See published a deep-dive analysis of the macOS variant. The sample, disguised as a video file (types-config.ts) but actually a universal Mach-O binary supporting both Intel and Apple Silicon, uses an adhoc code signature to evade suspicion. On execution, it copies itself to ~/Library/MacOsServices/updateMacOs and installs a LaunchAgent (com.apple.update.plist) for persistence with RunAtLoad enabled.

The malware retrieves its C2 address by downloading a base64-encoded, XOR-encrypted string from a hosted Google Drive text file, decrypting it to resolve graphic-updater.com (23.254.131.176). It then beacons a system survey (username, OS, AV, IP) to the C2 endpoint https://graphic-updater.com/api/attach using a spoofed Safari user-agent. The backdoor supports two primary tasking commands: 'exec', which downloads, unzips, chmods, and executes a remote payload, and 'cmd', which runs arbitrary shell commands via popen and exfiltrates the output to the C2 server.

The researchers note the malware was first discovered targeting a Linux-based web server at an educational institution before Windows and macOS variants were identified. Objective-See demonstrated that their free tools (BlockBlock, LuLu, KnockKnock) detected the malware's persistence and C2 beaconing behavior without prior signature knowledge, underscoring behavioral detection value against this first-stage backdoor.

title: LaunchAgent Persistence Installation by Non-System Process
description: Detects a process copying or writing a LaunchAgent plist to ~/Library/LaunchAgents/
  with RunAtLoad enabled. Typical macOS backdoor persistence post-execution. Generalises
  on the directory path and RunAtLoad key, not campaign-specific plist names.
tags:
- attack.persistence
- attack.t1547.001
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
    - /Library/LaunchAgents/
    TargetFilename|endswith: .plist
    FileContent|contains: RunAtLoad
  filter_apple_updates:
    TargetFilename|contains:
    - /Library/Updates/
    - com.apple.softwareupdate
  filter_mdm_deployment:
    Image|contains:
    - /usr/libexec/
    - /Library/Application Support/
  condition: selection and not filter_apple_updates and not filter_mdm_deployment
falsepositives:
- Legitimate application installers configuring LaunchAgents with RunAtLoad
- MDM or device management tools deploying persistence mechanisms
level: high
id: e5d7092a-fa61-57b5-b729-b6a604f509cf
status: experimental
author: Vorant

title: Suspicious Self-Copy to Library MacOsServices Directory
description: Detects a process copying or moving itself to ~/Library/MacOsServices/
  directory, which mimics legitimate Apple library paths. Generalises on the distinctive
  directory path pattern and self-copy behaviour, not specific filenames.
tags:
- attack.persistence
- attack.t1036.008
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains: /Library/MacOsServices/
    Image|endswith:
    - /bin/cp
    - /bin/mv
  filter_admin_scripts:
    ParentImage|contains:
    - /usr/libexec/
    - /Applications/
  condition: selection and not filter_admin_scripts
falsepositives:
- Administrative scripts or software deployment tools copying binaries to custom library
  paths
level: medium
id: 001c6ff4-442f-5f80-b854-218cac19d823
status: experimental
author: Vorant

title: Shell Process Exfiltrating Output to Remote HTTPS Endpoint
description: Detects a shell (sh/bash) spawned by a non-shell parent process executing
  curl or wget to exfiltrate command output to a remote HTTPS endpoint. Typical backdoor
  tasking response exfiltration. Generalises on the parent/child relation and piping
  to curl/wget, not specific domains or IP addresses.
tags:
- attack.exfiltration
- attack.t1102.002
logsource:
  category: process_creation
  product: macos
detection:
  selection_shell:
    Image|endswith:
    - /bin/sh
    - /bin/bash
    ParentImage|endswith:
    - /bin/bash
    CommandLine|contains:
    - curl
    - wget
  selection_https:
    CommandLine|contains:
    - https://
    - /api/
  filter_legitimate_curl:
    ParentImage|contains:
    - /usr/libexec/
    - /Applications/
  condition: (selection_shell and selection_https) and not filter_legitimate_curl
falsepositives:
- Legitimate system administration scripts downloading or uploading files via curl
- Software installers or package managers using shell to fetch remote content
level: medium
id: ca9e411d-4608-577d-bb6c-d85bbabb5a2e
status: experimental
author: Vorant

Source reporting: https://objective-see.org/blog/blog_0x6C.html