#Hancom office s viewer virus install
#Hancom office s viewer virus code
#Hancom office s viewer virus download
#Hancom office s viewer virus mac

Other interesting file extensions in this list are. 3ga extensions), which is specifically designed for speech compression. The most uncommon format is perhaps audio recordings using the Adaptive Multi-Rate codec (using the. The default list of file extensions found in the analyzed sample, pictured in Figure 7, shows that operators are interested in documents, spreadsheets, audio recordings, pictures, and email messages from the victims’ Macs. File extensions that are of interest to the operators.Paths to various directories used by CloudMensis.Which cloud storage providers to use and authentication tokens.The configuration contains the following: Additionally, it also tries to import values from what seem to be previous versions of the CloudMensis configuration at: If this file does not already exist, the configuration is populated with default values hardcoded in the malware sample. It is stored on disk at ~/Library/Preferences/, encrypted using a simple XOR with a generated key (see the Custom encryption section). This is a binary structure that is 14,972 bytes long. One of the first things the CloudMensis spy agent does is load its configuration. The configuration included in the analyzed sample contains authentication tokens for pCloud and Yandex Disk. It supports three different providers: pCloud, Yandex Disk, and Dropbox. The intention of the attackers here is clearly to exfiltrate documents, screenshots, email attachments, and other sensitive data.ĬloudMensis uses cloud storage both for receiving commands from its operators and for exfiltrating files. The second stage of CloudMensis is a much larger component, packed with a number of features to collect information from the compromised Mac. Sending an XPC message to speechsynthesisd The spy agent component It also suggests that CloudMensis may have been around for many years.įigure 6.

#Hancom office s viewer virus code

This could explain why this code is no longer called.

#Hancom office s viewer virus install

All four were patched by Apple the same year, so this distribution technique is probably not used to install CloudMensis anymore. These vulnerabilities were discovered and well documented by Niklas Baumstark and Samuel Groß in 2017. We initially thought the purpose of removeRegistration was to uninstall previous versions of CloudMensis, but further research showed that these files are used to launch sandbox and privilege escalation exploits from Safari while abusing four vulnerabilities. A first glance at this method is a bit puzzling considering that the things it does seem unrelated: it deletes a file called root from the EFI system partition (Figure 5), sends an XPC message to speechsynthesisd (Figure 6), and deletes files from the Safari cache directory. The first-stage component includes an interesting method called removeRegistration that seems to be present to clean up after a successful Safari sandbox escape exploit. CloudMensis downloader installing the second stage Cleaning up after usage of a Safari exploit In the sample we analyzed, pCloud was used to store and deliver the second stage.įigure 4.

#Hancom office s viewer virus download

It doesn’t use a publicly accessible link it includes an access token to download the MyExecute file from the drive. Interestingly, this first-stage malware retrieves its next stage from a cloud storage provider. However, we understand that when code execution and administrative privileges are gained, what follows is a two-stage process (see Figure 1), where the first stage downloads and executes the more featureful second stage. We still do not know how victims are initially compromised by this threat. Samples we analyzed are compiled for both Intel and Apple silicon architectures.

CloudMensis overviewĬloudMensis is malware for macOS developed in Objective-C. This blogpost describes the different components of CloudMensis and their inner workings. Disabling entry points, at the expense of a less fluid user experience, sounds like a reasonable way to reduce the attack surface. Although not the most advanced malware, CloudMensis may be one of the reasons some users would want to enable this additional defense. Its capabilities clearly show that the intent of its operators is to gather information from the victims’ Macs by exfiltrating documents, keystrokes, and screen captures.Īpple has recently acknowledged the presence of spyware targeting users of its products and is previewing Lockdown Mode on iOS, iPadOS and macOS, which disables features frequently exploited to gain code execution and deploy malware. Following analysis, we named it CloudMensis.

#Hancom office s viewer virus mac

In April 2022, ESET researchers discovered a previously unknown macOS backdoor that spies on users of the compromised Mac and exclusively uses public cloud storage services to communicate back and forth with its operators.

Previously unknown macOS malware uses cloud storage as its C&C channel and to exfiltrate documents, keystrokes, and screen captures from compromised Macs