BundloreMalware
- osx.bundlore
- surfbuyer
Bundlore is adware written for macOS that has been in use since at least 2015. Though categorized as adware, Bundlore has many features associated with more traditional backdoors.From MITRE ATT&CK
Last reported 23 months ago, by Group-IB3 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: AppleScript”
- T1059.002AppleScript
“T1059.002”
- T1059.004Unix Shell
“T1059.004”
- T1105Ingress Tool Transfer
“T1105”
- T1553.001Gatekeeper Bypass
“However, this may not be the case for possibly other future samples that are properly signed and notarized, or coupled with macOS Gatekeeper bypasses.”
- T1553.002Code Signing
“We anticipate that this tool may soon be utilized in future cyberattacks after it has been made further robust – with code signing, notarization, obfuscation, and a more inconspicuous custom attribute name.”
What the reports say
3 reports, newest first · the exact sentence from each-
Stealthy Attributes of Lazarus APT Group: Evading Detection with Extended Attributes“While researching malware abusing extended attributes, the most similar technique found was one back in 2020, where Bundlore adware hid its payload in resource forks, and accessed via the special path `filename/..namedfork/rsrc`.”
-
dmXProtect: Stop, Drop, Shut Malware Down“As we can see below, via the Description key, XProtect here is looking to block the Bundlore malware.”
-
macOS Support Is Here!“One example we’ve found during this time is Bundlore.”
Indicators in its reports
named in the reports above- xprotect[.]appin 1 report
- hxxps://filedn[.]com/lY24cv0IfefboNEIN0I9gqR/dragonfly/Discussion%20Points%20for%20Synergy%20Exploration_Over.pdfin 1 report
- filedn[.]comin 1 report
- hxxps://support.cloudstore[.]business/256977/checkin 1 report
- support.cloudstore[.]businessin 1 report
- hxxps://support.docsend[.]site/519529/checkin 1 report
- support.docsend[.]sitein 1 report
- 104.168.165[.]203in 1 report
- 104.168.157[.]45in 1 report
- hxxps://filedn[.]com/lY24cv0IfefboNEIN0I9gqRin 1 report
- 7464850d7d689141…c202786f9422in 1 report
- f3e6e8df132155da…37519ab3cb58in 1 report
- e87177e07ab9651b…edd79af0a74fin 1 report
- 022344029b8bf951…9bbaa5e5528ein 1 report
- 9111d458d5665b1b…c11f34d018c2in 1 report
- 4bce97eff4430708…85df25e6d357in 1 report
- 878e3701df9b0abd…75f2c84d8552in 1 report
- 176e8a5a7b6737f8…8aeaf2758c2din 1 report
- 48ee5d0d44a01587…fa8497d57215in 1 report
- a4cab67569d0b35c…6c0a241b792ain 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.