Sysjoker Malware got you down? Jamf’s got you covered

Jamf Threat Labs updates Jamf Protect to completely prevent SysJoker from threatening the security of your macOS fleet.

January 13 2022 by

Matthias Wollnik

Threat: SysJoker (backdoor)

Intezer published an in-depth analysis into a new cross-platform backdoor that was discovered in the wild. Objective-See also published a macOS-specific analysis.

It appears to be a targeted attack.

Affects: SysJoker affects macOS, Linux, and Windows (both Intel and Apple Silicon) devices.

Detected by: Jamf Protect detects SysJoker as part of the PlistDisguisedAsApple analytic.

Prevented by: Jamf Protect prevents SysJoker from running through Jamf Threat Prevention as of 1/12/2022.

Jamf Threat Defense prevents communication with all known C2 servers as of 1/12/2022.

IOCs (as published by Intezer with some additions):

Mac 554aef8bf44e7fa941e1190e41c8770e90f07254 - MachO Universal Binary 0622ad0377673ca4723e2190696c16e8c90e779a - x86-64 Executable (within Universal Binary) f639975bcb89262d73369fbb6d051643804b18cd - MachO Arm Executable (within Universal Binary) C2 https[://]bookitlab[.]tech https[://]winaudio-tools[.]com https[://]graphic-updater[.]com https[://]github[.]url-mini[.]com https[://]office360-update[.]com https[://]drive[.]google[.]com/uc?export=download&id=1-NVty4YX0dPHdxkgMrbdCldQCpCaE-Hn https[://]drive[.]google[.]com/uc?export=download&id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eu ELF bd0141e88a0d56b508bc52db4dab68a49b6027a486e4d9514ec0db006fe71eed d028e64bf4ec97dfd655ccd1157a5b96515d461a710231ac8a529d7bdb936ff3 Windows 61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc 1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c

Detection Content

Mac

Files and directories created on the machine:

/Library/MacOsServices
/Library/MacOsServices/updateMacOs
/Library/SystemNetwork
/Library/LaunchAgents/com.apple.update.plist

Persistence: Creates persistence via LaunchAgent under the path /Library/LaunchAgents/com.apple.update.plist.

Content:

> <?xml version=”1.0″ encoding=”UTF-8″?> > <!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”> > <plist version=”1.0″> > <dict> > <key>Label</key> > <string>com.apple.update</string> > <key>LimitLoadToSessionType</key> > <string>Aqua</string> > <key>ProgramArguments</key> > <array> > <string>/Library/MacOsServices/updateMacOs</string> > </array> > <key>KeepAlive</key> > <dict> > <key>SuccessfulExit</key> > <true/> > </dict> > <key>RunAtLoad</key> > <true/> > </dict> > </plist>

Linux

Files and directories created on the machine:

/.Library/
/.Library/SystemServices/updateSystem
/.Library/SystemNetwork
/.Library/log.txt

Persistence: Creates the cron job:

@reboot (/.Library/SystemServices/updateSystem)

Commands:

crontab -l | egrep -v “^(#|$)” | grep -e “@reboot (/.Library/SystemServices/updateSystem)” cp -rf <sample name> /.Library/SystemServices/updateSystem nohup ‘/.Library/SystemServices/updateSystem’ >/dev/null 2>&1 & ifconfig | grep -v 127.0.0.1 | grep -E “inet ([0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})” | awk ‘{print $2}’ ip address | awk ‘/ether/{print $2}’ id -u uname -mrs

Windows

Files and directories created on the machine:

C:\ProgramData\RecoverySystem
C:\ProgramData\RecoverySystem\recoveryWindows.zip
C:\ProgramData\RecoverySystem\msg.exe
C:\ProgramData\SystemData
C:\ProgramData\SystemData\igfxCUIService.exe
C:\ProgramData\SystemData\tempo1.txt
C:\ProgramData\SystemData\tempo2.txt
C:\ProgramData\SystemData\tempi1.txt
C:\ProgramData\SystemData\tempi2.txt
C:\ProgramData\SystemData\temps1.txt
C:\ProgramData\SystemData\temps2.txt
C:\ProgramData\SystemData\tempu.txt
C:\ProgramData\SystemData\microsoft_Windows.dll

Persistence: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun

Name: igfxCUIService Type: REG_SZ Data: “C:\ProgramData\SystemData\igfxCUIService.exe”

Commands:

“C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” getmac | Out-File -Encoding ‘Default’ ‘C:\ProgramData\SystemData\temps1.txt’ ; wmic path win32_physicalmedia get SerialNumber | Out-File -Encoding ‘Default’ ‘C:\ProgramData\SystemData\temps2.txt’ “C:\Windows\System32\Wbem\WMIC.exe” path win32_physicalmedia get SerialNumber “C:\Windows\system32\getmac.exe” “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” $env:username | Out-File -Encoding ‘Default’ ‘C:\ProgramData\SystemData\tempu.txt’ “C:\Windows\System32\cmd.exe” /c wmic OS get Caption, CSDVersion, OSArchitecture, Version / value > “C:\ProgramData\SystemData\tempo1.txt” && type “C:\ProgramData\SystemData\tempo1.txt” > “C:\ProgramData\SystemData\tempo2.txt” wmic OS get Caption, CSDVersion, OSArchitecture, Version / value “C:\Windows\System32\cmd.exe” /c wmic nicconfig where ‘IPEnabled = True’ get ipaddress > “C:\ProgramData\SystemData\tempi1.txt” && type “C:\ProgramData\SystemData\tempi1.txt” > “C:\ProgramData\SystemData\tempi2.txt” wmic nicconfig where ‘IPEnabled = True’ get ipaddress “C:\Windows\System32\cmd.exe” /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V igfxCUIService /t REG_SZ /D “C:\ProgramData\SystemData\igfxCUIService.exe” /F REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V igfxCUIService /t REG_SZ /D “C:\ProgramData\SystemData\igfxCUIService.exe” /F

Don't joke around with your macOS enterprise security!

Trust Jamf Protect to keep your Mac fleet and sensitive data secured against existing and emerging threats.

Request Trial

Subscribe to the Jamf Blog

Have market trends, Apple updates and Jamf news delivered directly to your inbox.

Email Address (Work)

To learn more about how we collect, use, disclose, transfer, and store your information, please visit our Privacy Policy.

Tags: