Undetected Golang-Based Stealer Emerges and Baffles Security Vendors
In recent years, macOS has become increasingly popular among users, largely due to its user-friendly interface, which is often commended for its simplicity and ease of use.
macOS is also often perceived as being more secure than other operating systems. Despite this, Threat Actors (TAs) have continued to target macOS platforms. Previously, there have been several cases where Threat Actors have targeted macOS users with various families of malware, including MacStealer, RustBucket, DazzleSpy, etc.
Cyble Research and Intelligence Labs (CRIL) recently discovered a Telegram channel advertising a new information-stealing malware called Atomic macOS Stealer (AMOS). The malware is specifically designed to target macOS and can steal sensitive information from the victim’s machine.
The TA behind this stealer is constantly improving this malware and adding new capabilities to make it more effective. The most recent update to the malware was highlighted in the Telegram post on April 25th, showcasing its latest features.
The Atomic macOS Stealer can steal various types of information from the victim’s machine, including keychain passwords, complete system information, files from the desktop and documents folder, and even the macOS password. The stealer is designed to target multiple browsers and can extract auto-fills, passwords, cookies, wallets, and credit card information. Specifically, AMOS can target cryptowallets such as Electrum, Binance, Exodus, Atomic, and Coinomi.
The TA also provides additional services such as a web panel for managing victims, meta mask brute-forcing for stealing seed and private keys, crypto checker, and dmg installer, after which it shares the logs via Telegram. These services are offered at a price of $1000 per month.
Technical Analysis
For our analysis, we have taken the sample hash (SHA256) of “Setup.dmg” as 15f39e53a2b4fa01f2c39ad29c7fe4c2fef6f24eff6fa46b8e77add58e7ac709, which is FUD (stands for “Fully Undetectable”) on Virustotal at the time of writing this analysis.
The TAs use a ‘.dmg’ file to disseminate this malware, including a Mac OS X executable, located at “/Setup.app/Contents/macOS/My Go Application.app” and is a 64-bit Golang executable file.
The Atomic macOS Stealer’s primary function encompasses all of its capabilities, including keychain extraction, crypto wallet theft, stealing browser details, grabbing user files, collecting system information, and sending all the stolen data to the remote C&C server.
The main functions of the stealer are depicted in the figure below.
Once a user executes the file, it displays a fake password prompt to obtain the system password, as shown in the figure below.
Keychain Password Extraction
In addition to obtaining the system password, the malware also targets the password management tool by utilizing the main_keychain() function to extract sensitive information from the victim’s machine. Keychain is a macOS password management system that enables users to safely store sensitive data such as website logins, Wi-Fi passwords, credit card details, and more.
The code snippet depicted in the figure below exhibits the main_keychain() function, implemented to gather the user’s credentials.
Stealing Crypto Wallets
After that, the stealer begins to extract information related to crypto-wallets by querying and reading files from specific directories using the function main_GrabWallets(). The stealer targets crypto wallets such as Electrum, Binance, Exodus, and Atomic, as shown below.
Crypto Wallet Extension
The Atomic macOS stealer can also extract information from crypto wallet browser extensions. These extensions are integrated into the stealer binary via hard coding, with over 50 extensions being targeted thus far.
The table below highlights some crypto wallets with respective browser extension IDs targeted by the malware.
| acmacodkjbdgmoleebolmdjonilkdbch | Rabby Wallet |
| aeachknmefphepccionboohckonoeemg | Coin98 Wallet |
| afbcbjpbpfadlkmhmclhkeeodmamcflc | Math Wallet |
| aholpfdialjgjfhomihkjbmgjidlcdno | Exodus Web3 Wallet |
| aiifbnbfobpmeekipheeijimdpnlpgpp | Station Wallet |
| amkmjjmmflddogmhpjloimipbofnfjih | Wombat – Gaming Wallet for Ethereum & EOS |
| apnehcjmnengpnmccpaibjmhhoadaico | CWallet |
| bcopgchhojmggmffilplmbdicgaihlkp | Hycon Lite Client |
| bfnaelmomeimhlpmgjnjophhpkkoljpa | Phantom |
| bocpokimicclpaiekenaeelehdjllofo | XDCPay |
| cgeeodpfagjceefieflmdfphplkenlfk | EVER Wallet |
| cihmoadaighcejopammfbmddcmdekcje | LeafWallet |
| cjelfplplebdjjenllpjcblmjkfcffne | Jaxx Liberty |
| cjmkndjhnagcfbpiemnkdpomccnjblmj | Finnie |
| cmndjbecilbocjfkibfbifhngkdmjgog | Swash |
| cnmamaachppnkjgnildpdmkaakejnhae | Auro |
| copjnifcecdedocejpaapepagaodgpbh | Freaks Axie |
| cphhlgmgameodnhkjdmkpanlelnlohao | NeoLine |
| dhgnlgphgchebgoemcjekedjjbifijid | Crypto Airdrops & Bounties |
| dkdedlpgdmmkkfjabffeganieamfklkm | Cyano |
| dmkamcknogkgcdfhhbddcghachkejeap | Keplr |
| efbglgofoippbgcjepnhiblaibcnclgk | Martian Wallet for Sui & Aptos |
| egjidjbpglichdcondbcbdnbeeppgdph | Trust Wallet |
| ffnbelfdoeiohenkjibnmadjiehjhajb | Yoroi |
| fhbohimaelbohpjbbldcngcnapndodjp | BinanceChain |
| fhilaheimglignddkjgofkcbgekhenbh | Oxygen |
| flpiciilemghbmfalicajoolhkkenfel | ICONex |
| fnjhmkhhmkbjkkabndcnnogagogbneec | Ronin |
| fnnegphlobjdpkhecapkijjdkgcjhkib | Harmony Wallet |
| hcflpincpppdclinealmandijcmnkbgn | KHC |
| hmeobnfnfcmdkdcmlblgagmfpfboieaf | XDEFI |
| hnfanknocfeofbddgcijnmhnfnkdnaad | Coinbase |
| hnhobjmcibchnmglfbldbfabcgaknlkj | Flint Wallet |
| hpglfhgfnhbgpjdenjgmdgoeiappafln | Guarda |
| ibnejdfjmmkpcnlpebklmnkoeoihofec | TronLink |
| imloifkgjagghnncjkhggdhalmcnfklk | Trezor Password Manager |
| jojhfeoedkpkglbfimdfabpdfjaoolaf | Polymesh |
| klnaejjgbibmhlephnhpmaofohgkpgkd | ZilPay |
| kncchdigobghenbbaddojjnnaogfppfj | iWallet |
| kpfopkelmapcoipemfendmdcghnegimn | Liquality |
| lodccjjbdhfakaekdiahmedfbieldgik | DAppPlay |
| mfhbebgoclkghebffdldpobeajmbecfk | Starcoin |
| mnfifefkajgofkcjkemidiaecocnkjeh | TezBox |
| nhnkbkgjikgcigadomkphalanndcapjk | CLW |
| nkbihfbeogaeaoehlefnkodbefgpgknn | Metamask |
| nknhiehlklippafakaeklbeglecifhad | Nabox |
| nlbmnnijcnlegkjjpcfjclmcfggfefdm | MewCx |
| nlgbhdfgdhgbiamfdfmbikcdghidoadd | Byone |
| nphplpgoakhhjchkkhmiggakijnkhfnd | Ton |
| ookjlbkiijinhpmnjffcofjonbfbgaoc | Temple |
| pdadjkfkgcafgbceimcpbkalnfnepbnk | KardiaChain |
| pnndplcbkakcplkjnolgbkdgjikjednm | Tron Wallet & Explorer – Tronium |
| pocmplpaccanhmnllbbkpgfliimjljgo | Slope |
| ppdadbejkmjnefldpcdjhnkpbjkikoip | Oasis |
Extracting Browser Information
After collecting wallet details, the malware queries the installed browsers’ directories on the victim’s device and searches for particular browser-related files to extract confidential data, such as:
- Autofills
- Passwords
- Cookies
- Credit Cards
As depicted below, the malware can steal files from various browsers, including Mozilla Firefox, Google Chrome, Microsoft Edge, Yandex, Opera, and Vivaldi.
File Grabber
The stealer now steals the victim’s files from directories such as Desktop and Documents using the main_FileGrabber() function. The figure below shows the malware requesting permission to access files within the specified directories.
The code snippet in the figure below displays the main_FileGrabber() function, which is implemented to grab files from the victim’s system.
Collecting System Information
Subsequently, the malware starts the process of obtaining further hardware-related information regarding the system, such as the Model name, Hardware UUID, RAM size, the number of cores, and serial number, among other information. This is illustrated in the figure below.
Command and Control (C&C)
Finally, the Atomic macOS stealer processes the stolen information by compressing into ZIP and encoding it using Base64 format for exfiltration.
The stealer communicates with the below C&C server URL and sends the stolen information.
- hxxp[:]//amos-malware[.]ru/sendlog
The figure below shows the network communication of data exfiltration from the victim’s machine.
Concurrently, the Atomic macOS stealer sends selected information to Telegram channels along with the compiled ZIP file, as shown below.
C&C Panel
The below figure shows Atomic macOS stealer’s active C&C panel.
Conclusion
Due to its robust security features, macOS is the preferred operating system for numerous high-profile individuals. Targeting macOS is not a novel trend, and various malware families exist that specifically aim to infiltrate this operating system.
Malware such as the Atomic macOS Stealer could be installed by exploiting vulnerabilities or hosting on phishing websites. Threat Actors can use the stolen data for espionage or financial gain. While not commonplace, macOS malwares can have devastating impacts on victims.
Our Recommendations
We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:
- Download and install software only from the official Apple App Store.
- Use a reputed antivirus and internet security software package on your system.
- Use strong passwords and enforce multi-factor authentication wherever possible.
- Enable biometric security features such as fingerprint or facial recognition for unlocking the device wherever possible.
- Be wary of opening any links received via emails delivered to you.
- Be careful while enabling any permissions.
- Keep your devices, operating systems, and applications updated.
MITRE ATT&CK® Techniques
| Tactic | Technique ID | Technique Name |
| Execution | T1204.002 | User Execution: Malicious File |
| Credential Access | T1110 | Brute Force |
| Credential Access | T1555.001 | Keychain |
| Credential Access | T1555.003 | Credentials from Web Browsers |
| Discovery | T1083 | File and Directory Discovery |
| Command and Control | T1132.001 | Data Encoding: Standard Encoding |
| Exfiltration | T1041 | Exfiltration Over C&C Channel |
Indicators of Compromise (IoC)
| Indicators | Indicators Type | Description |
| 5e0226adbe5d85852a6d0b1ce90b2308 0a87b12b2d12526c8ba287f0fb0b2f7b7e23ab4a 15f39e53a2b4fa01f2c39ad29c7fe4c2fef6f24eff6fa46b8e77add58e7ac709 | MD5 SHA1 SHA256 | Setup.dmg |
| amos-malware[.]ru | Domain | C&C |
| hxxp[:]//amos-malware[.]ru/sendlog | URL | C&C |
