‘WizardUpdate’ malware recasts a malicious spell, yet still no match for Jamf Protect

Jamf Threat Labs updates Jamf Protect to completely prevent UpdateAgent/WizardUpdate from threatening the security of your macOS fleet.

February 11 2022 by

Matthias Wollnik

Threat: UpdateAgent/WizardUpdate

The UpdateAgent family of malware has been actively circulating since 2020. Microsoft recently reported the latest variant of the family.

Affects: UpdateAgent is a Mac-targeted trojan that masquerades as legitimate software. The attack payload has varied over time from information gathering to adware deployment. It is actively being developed.

Detected by: Jamf Protect detected UpdateAgent (also known as WizardUpdate) as of 12/30/20 with new variants added, as discovered.

Prevented by: Jamf Protect detected UpdateAgent (also known as WizardUpdate) as of 12/30/20 with new variants added, as discovered.

IOCs (as published by Microsoft):

1966d64e9a324428dec7b41aca852034cbe615be1179ccb256cf54a3e3e242ee ef23a1870d84e164a4234074251205190a5dfda9f465c8eee6c7e0d6878c2b05 519339e67b1d421d51a0f096e80a57083892bac8bb16c7e4db360bb0fda3cb11 cc2f246dda46b17e9302242879788aa114ee64327c8de43ef2b9ab56e8fb57b2 5c1704367332a659f6e10d55d08a3e0ab1bd26aa97654365dc82575356c80502 c60e210f73d5335f57f367bd7e166ff4c17f1073fd331370eb63342ab1c82238 f01dec606db8f66489660615c777113f9b1180a09db2f5d19fb5bca7ba3c28c7 4f1399e81571a1fa1dc822b468453122f89ac323e489f57487f6b174940e9c2e 9863bc1917af1622fdeebb3bcde3f7bebabcb6ef13eae7b571c8a8784d708d57 a1fba0bb0f52f25267c38257545834a70b82dbc98863aee01865a2661f814723 81cfa53222fa473d91e2a7d3a9591470480d17535d49d91a1d4a7836ec943d3a 78b4478cd3f91c42333561abb9b09730a88154084947182b2ec969995b25ad78 91824c6a36ef60881b4f502102b0c068c8a3acd4bceb86eb4ffd1043f7990763 86b45b861a8f0855c97cc38d2be341cc76b4bc1854c0b42bdca573b39da026ac 84ff961552abd742cc2393dde20b7b3b7b2cfb0019c80a02ac24de6d5fcc0db4 0ee6c8fd43c03e8dc7ea081dfa428f22209ed658f4ae358b867de02030cfc69b 443b6173ddfbcc3f19d69f60a1e5d72d68d28b7323fe2953d051b32b4171aa9a 409f1b4aeb598d701f6f0ed3b49378422c860871536425f7835ed671ba4dd908 77f084b5fc81c9c885a9b1683a12224642072f884df9e235b78941a1ad69b80d cbabbbb270350d07444984aa0ce1bb47078370603229a3f03a431d6b7a815820 053fbb833ac1287d21ae96b91d9f5a9cfdd553bc41f9929521d4043e91e96a98 29e3d46867caddde8bb429ca578dd04e5d7112dd730cd69448e5fb54017a2e30 356d429187716b9d5562fe6eee35ea60b252f1845724b0a7b740fbddec73350f a98ecd8f482617670aaa7a5fd892caac2cfd7c3d2abb8e5c93d74c344fc5879c c94760fe237da5786464ec250eadf6f7f687a3e7d1a47e0407811a586c6cb0fc eb71d15308bfcc00f1b80bedbe1c73f1d9e96fd55c86cf420f1f4147f1604f67 0c08992841d5a97e617e72ade0c992f8e8f0abc9265bdca6e09e4a3cb7cb4754 738822e109f1b14413ee4af8d3d5b2219293ea1a387790f207d937ca11590a14 0d9f861fe4910af8299ac3cb109646677049fa9f3188f52065a47e268438b107 a586ef06ab8dd6ad1df77b940028becd336a5764caf097103333975a637c51fa 73a465170feed88048dbc0519fbd880aca6809659e011a5a171afd31fa05dc0b d5c808926000bacb67ad2ccc4958b2896ea562f27c0e4fc4d592c5550e39a741 7067e6a69a8f5fdbabfb00d03320cfc2f3584a83304cbeeca7e8edc3d57bbbd4 939cebc99a50989ffbdbb2a6727b914fc9b2382589b4075a9fd3857e99a8c92a c5017798275f054ae96c69f5dd0b378924c6504a70c399279bbf7f33d990d45b 57d46205a5a1a5d6818ecd470b61a44aba0d935f256265f5a26d3ce791038fb4 e8d4be891c518898dd3ccdff4809895ed21558d90d415cee868bebdab2da7397 9f1989a04936cd8de9f5f4cb1f5f573c1871b63737b42d18ac4fa337b089cbdc b55c806367946a70d619f25e836b6883a36c9ad22d694a173866b57dfe8b29c9 e46b09b270552c7de1311a8b24e3fcc32c8db220c03ca0d8db05e08c76e536f1 f9842e31ed16fe0173875c38a41ed3a766041350b4efcd09da62718557ca3033 bad5dc1dd6ff19f9fb1af853a8989c1b0fdfeaa4c588443607de03fccf0e21c9

Web exploit URLs:

hxxps[://]d35ep4bg5x8d5j[.]cloudfront[.]net/pkg hxxps[://]d7rp2fva69arq[.]cloudfront[.]net/pkg hxxps[://]daqi268hfl8ov[.]cloudfront[.]net/pkg hxxps[://]events[.]optimizerservices[.]com/pkg hxxps[://]ekogidekinvgwyzmeydw[.]s3[.]amazonaws[.]com/OptimizerProcotolStatus[.]zip hxxps[://]lnzjvpeyarvvvtljxsws[.]s3[.]amazonaws[.]com/ConsoleSoftwareUpdateAgent[.]zip hxxps[://]qqirhvehhnvuemxezfxc[.]s3[.]amazonaws[.]com/ModuleAgent[.]zip hxxps[://]dpqsxofvslaxjaiyjdok[.]s3[.]amazonaws[.]com/ProtocolStatus[.]zip hxxps[://]oldbrlauserz[.]s3[.]amazonaws[.]com/setup[.]zip hxxps[://]grxqorfazgqbmzeetpus[.]s3[.]amazonaws[.]com/SetupUpdateAgent[.]zip hxxps[://]phdhrhdsp[.]s3[.]amazonaws[.]com/setup[.]zip hxxps[://]xyxeaxtugahkwrcvbzsw[.]s3[.]amazonaws[.]com/BundleAgent[.]zip hxxps[://]tnkdcxekehzpnpvimdwquzwzgpehlnwgizrlmzev[.]s3[.]amazonaws[.]com/HelperModule[.]zip hxxps[://]svapnilpkasjmwtygfstkhsdfrraa[.]s3[.]amazonaws[.]com/WizardUpdate[.]zip

Don't let your Mac fleet become hexed, cursed or jinxed...

Jamf Protect casts Expelliarmus on the macOS malware looking to compromise the security of you macOS endpoints!

Subscribe to the Jamf Blog

Have market trends, Apple updates and Jamf news delivered directly to your inbox.

Email Address (Work)

To learn more about how we collect, use, disclose, transfer, and store your information, please visit our Privacy Policy.

Tags: