This fileless method is more typical for Windows malware but is rarely seen in macOS threats. Wardle also said that the malware is capable of achieving in-memory execution of a payload. The Trojan still has a low detection rate on VirusTotal. The missing payload probably means that this new macOS Trojan was discovered before the Lazarus hackers had the chance to finalize all details and get ready for actual operations. Related: Lazarus Hackers Abuse FASTCASH Scheme Against Banks Worldwide However, Wardle’s analysis points that currently the command and control server is responding with a “0”, meaning that no payload is provided. The binary can also contact a command and control server for the payload, which shows that it is designed for the initial stage of the attack. The binary can also collect basic system information, including serial number and OS version. The hidden unioncryptoupdater binary will run each time the system is rebooted, and this is done by setting its RunAtLoad key to true. Thus, once the installer completes, the binary unioncryptoupdater will both currently executing, and persistently installed,“ Wardle said. „ Though installing a launch daemon requires root access, the installer will prompt the user for their credentials. move a hidden binary (.unioncryptoupdater) from the application’s Resources directory into /Library/UnionCrypto/Įxecute this binary (/Library/UnionCrypto/unioncryptoupdater) move a hidden plist (.) from the application’s Resources directory into /Library/LaunchDaemons New macOS Trojan Analyzed by Patrick WardleĪccording to Wardle’s analysis, the malware has a postinstall script that installs the launch daemon to achieve persistence. The sample is packaged as UnionCryptoTrader, and was hosted on a website known as, advertised as a smart cryptocurrency arbitrage trading platform. Devadoss also provided a hash for the malware sample. However, it was discovered by another security researcher, Dinesh Devadoss, who shared his findings in a tweet. The malware has been analyzed by Patrick Wardle. A new macOS Trojan has been uncovered, which, researchers believe, was developed by the Lazarus hacking group.

Lazarus daemon stop