New macOS Trojan-Proxy piggybacking on cracked software

Illegally distributed software historically has served as a way to sneak malware onto victims’ devices. Oftentimes, users are not willing to pay for software tools they need, so they go searching the Web for a “free lunch”. They are an excellent target for cybercriminals who realize that an individual looking for a cracked app will be willing to download an installer from a questionable website and disable security on their machine, and so they will be fairly easy to trick into installing malware as well.

We recently discovered several cracked applications distributed by unauthorized websites and loaded with a Trojan-Proxy. Attackers can use this type of malware to gain money by building a proxy server network or to perform criminal acts on behalf of the victim: to launch attacks on websites, companies and individuals, buy guns, drugs, and other illicit goods.

Postinstall script

Unlike the original, untampered with, applications typically distributed as a disk image, the infected versions came in the form of .PKG installers. These files are handled by the Installer dedicated utility in macOS, and they can run scripts before and after actual installation. In the examples we gathered, scripts were run only after the application was installed.

Contents of the malware script

A look at the script code reveals that the /Contents/Resources/ directory contains two suspicious files in addition to the cracked application resources: WindowServer and p.plist. The script replaces the ~/Library/Application Support/WindowServer and ~/Library/LaunchAgents/GoogleHelperUpdater.plist files with the two files from the resources folder, and grants administrator permissions to these. As an installer often requests administrator permissions to function, the script run by the installer process inherits those.

The p.plist (or GoogleHelperUpdater.plist) is a configuration file. Its contents suggest that it imitates a Google configuration file and has only one job: auto-starting the WindowServer file, with a path set to ${VAR}, as a system process after the operating system is loaded.

Contents of the p.plist file

WindowServer

WindowServer is a universal format binary file. We have found several versions of the application, with the earliest one uploaded to VirusTotal on April 28, 2023. None of the versions were flagged by any anti-malware vendors as malicious.

After starting, the Trojan creates log files and attempts to obtain a C&C server IP address via DNS-over-HTTPS (DoH), thus making the DNS request indistinguishable from a regular HTTPS request and hiding it from traffic monitoring.

Beginning of application code (MD5: 063d956b55da0d18f3f732c2bbd4bc28)

Example of GET request in C&C IP address function (MD5: 063d956b55da0d18f3f732c2bbd4bc28)

After receiving a response, it establishes a connection with the C&C server at register[.]akamaized[.]ca via WebSocket by sending the application version and expecting a command with a relevant message in return. See below for a list of supported commands.

Command #	Purpose
0x34	Process message
0x35	Pause command processing
0x36	Continue command processing
0x37	Terminate command processing
0x38	Await next command

During our research efforts, we did not receive a server response containing any command but 0x38. An analysis of the program code suggests that the 0x34 command should be accompanied by a message containing the IP address to connect to, the protocol to use and the message to send. The client supports both TCP and UDP connections.

TCP and UDP connection code (MD5: 063d956b55da0d18f3f732c2bbd4bc28)

As mentioned earlier, we have discovered several versions of the Trojan, with a number of distinguishing features:

Unlike its predecessors, the latest of the versions we know of cannot check its own version or update. The update function is there, but it is not invoked anywhere in the code.
Snippet of the update function (MD5: 063d956b55da0d18f3f732c2bbd4bc28)
Older versions obtain a C&C IP address by means of a regular DNS request rather than DoH.
All versions of the Trojan write logs to log.txt and dbg.dmp, without cleaning up after shutdown or providing any means for the operators to analyze the logs. Thus, it is possible to ascertain the presence of the malware in the system both by checking the known paths and searching for key tags across all text files.

Versions targeting other platforms

Besides the macOS application, we discovered several specimens for Android and Windows that connected to the same C&C server. These are also Trojan-Proxies that hide inside cracked software.