Trend Micro MacOS Backdoor November 2020

OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.

OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.

OSX_OCEANLOTUS.D has disguised it's true file structure as an application bundle by adding special characters to the filename and using the icon for legitimate Word documents.

OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.

OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.

OSX_OCEANLOTUS.D can use the touch -t command to change timestamps.

OSX_OCEANLOTUS.D can also use use HTTP POST and GET requests to send and receive C2 information.

OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the ioreg command to gather some of this information.

OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.

OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents.

OSX_OCEANLOTUS.D uses the command xattr -d com.apple.quarantine to remove the quarantine file attribute used by Gatekeeper.

OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.