On September 11, 2023, SentinelOne researchers reported the technical details a campaign targeting unspecified businesses that operate macOS in their environments with a series of infostealers written in Go they dubbed the “MetaStealer” family.
Context
According to the report, the campaign has been “proactively targeting macOS businesses by posing as fake clients in order to socially engineer victims into launching malicious payloads” for the past few months. The researchers also note that Apple has released a signature for XProtect that detects some variants of the MetaStealer Family.
Technical Details
According to SentinelOne researchers, the primary objective of the campaign is “exfiltrating valuable keychain and other information” from businesses to be used in further cybercriminal activity. Researchers provided the following key technical details:
- “Many of the samples of MetaStealer we have observed are distributed in malicious application bundles contained in disk image format (.dmg) with names indicating that the targets were business users of Mac devices.
- The main executable in MetaStealer bundles is an Intel x86 Mach-O containing compiled and heavily obfuscated Go source code.
- The applications inside the MetaStealer disk images contain the minimum required to form a valid macOS bundle, namely an Info.plist file, a Resources folder containing an icon image and a MacOS folder containing the malicious executable.”
Community Impact
The SentinelOne report did not identify the geolocations or industry verticals of targeted businesses, nor the number of targets. Thus, there is currently no public information to determine whether organizations in the retail, hospitality, or travel sectors have been targeted. However, organizations are advised to maintain awareness around the MetaStealer family, as well as other infostealer malware, which are frequently leveraged against organizations in the RH-ISAC community. Organizations are encouraged to ingest the indicators of compromise (IOCs) provided by SentinelOne and ensure all Apple devices are completely up to date where possible.
IOCs
SentinelOne provided the following IOCs:
|
Indicator |
Type |
Notes |
|
00b92534af61a6192321 |
SHA-256 |
Dropper: AdobeOfficialBriefDescription |
|
51e8eaf98b77105b448f |
SHA-256 |
Dropper: Adobe Photoshop 2023 |
|
14da5241119bf64d9a7ff |
SHA-256 |
Dropper: Advertising terms of reference |
|
c2cd344fbcd2d356ab82 |
SHA-256 |
Dropper: AnimatedPoster[.]dmg |
|
5ba3181df053e35011e9e |
SHA-256 |
Dropper: CardGame[.]dmg |
|
dec16514cd256613128b |
SHA-256 |
Dropper: Conract for paymen & |
|
d3fd59bd92ac03bccc119 |
SHA-256 |
Dropper: FreyaVR 1[.]6[.]102[.]dmg |
|
3033c05eec7c7b98d175 |
SHA-256 |
Dropper: Matrix[.]dmg |
|
345d6077bfb9c55e3d89b |
SHA-256 |
Dropper: OfficialBriefDescription |
|
35bfdb4ad20908ac85d00 |
SHA-256 |
Dropper: P7yersOfficialBrief |
|
aa40f3f71039096830f29 |
SHA-256 |
Dropper: PDF[.]app[.]zip |
|
e49c078b3c3f696d004f1 |
SHA-256 |
Dropper: TradingView[.]dmg |
|
3161e6c88a4da5e09193b |
SHA-256 |
Dropper: YoungClass brief |
|
61c3f2f3a7521920ce2db |
SHA-256 |
Dropper: YoungSUG(Cover references,tasks,logos,brief)\ |
|
0edd4b81fa931604040d |
SHA-256 |
Mach-O Binaries – Intel x86_64 |
|
13249e30a9918168e79c |
SHA-256 |
Mach-O Binaries – Intel x86_65 |
|
13bcebdb4721746671e |
SHA-256 |
Mach-O Binaries – Intel x86_66 |
|
1424f9245a3325c513a0 |
SHA-256 |
Mach-O Binaries – Intel x86_67 |
|
148bc97ff873276666e0 |
SHA-256 |
Mach-O Binaries – Intel x86_68 |
|
15c377eb5a69f93fa833e |
SHA-256 |
Mach-O Binaries – Intel x86_69 |
|
166ff1cd47a45e47721bb |
SHA-256 |
Mach-O Binaries – Intel x86_70 |
|
1b3ce71fa42f4c0c16af1b |
SHA-256 |
Mach-O Binaries – Intel x86_71 |
|
1cc66e194401f2164ff1cb |
SHA-256 |
Mach-O Binaries – Intel x86_72 |
|
1df31db0f3e5c381ad734 |
SHA-256 |
Mach-O Binaries – Intel x86_73 |
|
1df8ff1fe464a0d9baaeea |
SHA-256 |
Mach-O Binaries – Intel x86_74 |
|
1e5319969d6a53efc0ec1 |
SHA-256 |
Mach-O Binaries – Intel x86_75 |
|
291011119bc2a777b33cc |
SHA-256 |
Mach-O Binaries – Intel x86_76 |
|
2c567a37c49af5bce4a23 |
SHA-256 |
Mach-O Binaries – Intel x86_77 |
|
33a5043f8894a8525eeb2 |
SHA-256 |
Mach-O Binaries – Intel x86_78 |
|
34c7977e20acc8e641390 |
SHA-256 |
Mach-O Binaries – Intel x86_79 |
|
3589dd0d01527ca4e8a2e |
SHA-256 |
Mach-O Binaries – Intel x86_80 |
|
35c3b735949151aae28e |
SHA-256 |
Mach-O Binaries – Intel x86_81 |
|
35e14d8375f625b04be43 |
SHA-256 |
Mach-O Binaries – Intel x86_82 |
|
394501f410bd9cb4f4432a |
SHA-256 |
Mach-O Binaries – Intel x86_83 |
|
47620d2242dfaf14b776656 |
SHA-256 |
Mach-O Binaries – Intel x86_84 |
|
57c2302c30955527293e |
SHA-256 |
Mach-O Binaries – Intel x86_85 |
|
65de53298958b4f137c4 |
SHA-256 |
Mach-O Binaries – Intel x86_86 |
|
70625f621f91fd6b1a433 |
SHA-256 |
Mach-O Binaries – Intel x86_87 |
|
78e8f9a93b56adc8e030 |
SHA-256 |
Mach-O Binaries – Intel x86_88 |
|
80c83e659c63c963f55c |
SHA-256 |
Mach-O Binaries – Intel x86_89 |
|
816fdf1fd9cf9aff2121d1 |
SHA-256 |
Mach-O Binaries – Intel x86_90 |
|
86eb7c6a4d4bec5abeb6b |
SHA-256 |
Mach-O Binaries – Intel x86_91 |
|
8dfeda030bd3b38592b29 |
SHA-256 |
Mach-O Binaries – Intel x86_92 |
|
8ec57c1b1b5409cadb99b |
SHA-256 |
Mach-O Binaries – Intel x86_93 |
|
8f211c0ef570382685d02 |
SHA-256 |
Mach-O Binaries – Intel x86_94 |
|
90d7f8acf3524fcb58c7d7 |
SHA-256 |
Mach-O Binaries – Intel x86_95 |
|
92b178817a6c9ad22f10b |
SHA-256 |
Mach-O Binaries – Intel x86_96 |
|
a54c9906d41b04b9daf89 |
SHA-256 |
Mach-O Binaries – Intel x86_97 |
|
a8724eb5f9f8f4607b3841 |
SHA-256 |
Mach-O Binaries – Intel x86_98 |
|
b51d7482d38dd19b2cb1 |
SHA-256 |
Mach-O Binaries – Intel x86_99 |
|
bd6b87c6f4f256fb25536 |
SHA-256 |
Mach-O Binaries – Intel x86_100 |
|
bdd4ce8c2622ddcf0888 |
SHA-256 |
Mach-O Binaries – Intel x86_101 |
|
be1ac5ed5dfd295be15b |
SHA-256 |
Mach-O Binaries – Intel x86_102 |
|
c37751372bb6c970ab5c |
SHA-256 |
Mach-O Binaries – Intel x86_103 |
|
c4d9272ef906c7bf4ccc2a |
SHA-256 |
Mach-O Binaries – Intel x86_104 |
|
c5429b9b4d1a8e147f591 |
SHA-256 |
Mach-O Binaries – Intel x86_105 |
|
caf4fb1077cea9d75c8ae9 |
SHA-256 |
Mach-O Binaries – Intel x86_106 |
|
cf467ca23bdb81e008e73 |
SHA-256 |
Mach-O Binaries – Intel x86_107 |
|
cfa56e10c8185792f8a9d |
SHA-256 |
Mach-O Binaries – Intel x86_108 |
|
d7de135a03a2124c6e0d |
SHA-256 |
Mach-O Binaries – Intel x86_109 |
|
dbf0983b29a175ebbcf71 |
SHA-256 |
Mach-O Binaries – Intel x86_110 |
|
dfd5adb749cbc5608ca9 |
SHA-256 |
Mach-O Binaries – Intel x86_111 |
|
e5cfc40d04ea5b1dac2d |
SHA-256 |
Mach-O Binaries – Intel x86_112 |
|
f6f09ecc920eb694ed91e |
SHA-256 |
Mach-O Binaries – Intel x86_113 |
|
f93dd5e3504fe79f7fcd6 |
SHA-256 |
Mach-O Binaries – Intel x86_114 |
|
f97e22bad439d14c0539 |
SHA-256 |
Mach-O Binaries – Intel x86_115 |
|
fce7a0c00bfed23d6d70b |
SHA-256 |
Mach-O Binaries – Intel x86_116 |
|
13[.]114[.]196[.]60 |
IP Address |
Network Communications |
|
13[.]125[.]88[.]10 |
IP Address |
Network Communications |
|
api[.]osx-mac[.]com |
Domain |
Network Communications |
|
builder[.]osx-mac[.]com |
Domain |
Network Communications |
|
db[.]osx-mac[.]com |
Domain |
Network Communications |
|
hXXps[:]//api[.]osx-mac[.]com/api/collections/ |
URL |
Network Communications |
|
hXXp[:]//api[.]osx-mac[.]com/chainbreaker |
URL |
Network Communications |
