The Missing Piece – Sophisticated OS X Backdoor Discovered

Share this…

In a nutshell

  • Backdoor.OSX.Mokes.a is the most recently discovered OS X variant of a cross-platform backdoor which is able to operate on all major operating systems (Windows,Linux,OS X). Please see also ouranalysis on the Windows and Linux variants.
  • This malware family is able to steal various types of data from the victim’s machine (Screenshots, Audio-/Video-Captures, Office-Documents, Keystrokes)
  • The backdoor is also able to execute arbitrary commands on the victim’s computer
  • To communicate it’s using strong AES-256-CBC encryption


Back in January this year we found a new family of cross-platform backdoors for desktop environments. After the discovery of the binaries for Linux and Windows systems, we have now finally come across the OS X version of Mokes.A. It is written in C++ using Qt, a cross-platform application framework, and is statically linked to OpenSSL. This leads to a filesize of approx. 14MB. Let’s have a look into this very fresh sample.

“Unpacked” Backdoor.OSX.Mokes.a

Its filename was “unpacked” when we got our hands on it, but we’re assuming that in-the-wild it comes packed, just like its Linux variant.

Backdoor.OSX.Mokes.a Mach-O x86_64 file type


When executed for the first time, the malware copies itself to the first available of the following locations, in this order:

  • $HOME/Library/App Store/storeuserd
  • $HOME/Library/
  • $HOME/Library/Dock/
  • $HOME/Library/Skype/SkypeHelper
  • $HOME/Library/Dropbox/DropboxCache
  • $HOME/Library/Google/Chrome/nacld
  • $HOME/Library/Firefox/Profiles/profiled

Corresponding to that location, it creates a plist-file to achieve persistence on the system:

Backdoor.OSX.Mokes.a Persistence plist file

After that it’s time to establish a first connection with its C&C server using HTTP on TCP port 80:

Backdoor.OSX.Mokes.a HTTP Connection dump

The User-Agent string is hardcoded in the binary and the server replies to this “heartbeat” request with “text/html” content of 208 bytes in length. Then the binary establishes an encrypted connection on TCP port 443 using the AES-256-CBC algorithm.

Backdoor.OSX.Mokes.a IDA screenshot _AES_set_encrypt_key

Backdoor functionality

Its next task is to setup the backdoor features:

Backdoor.OSX.Mokes.a IDA screenshot EKomsUserActivity Methods

    • Capturing Audio

Backdoor.Mokes.a IDA screenshot AudioCaptureSession methods

    • Monitoring Removable Storage

Backdoor.OSX.Mokes.a IDA screenshot AbRemovableStorageMonitorService Methods

    • Capturing Screen (every 30 sec.)

Backdoor.OSX.Mokes.a IDA  screenshot AbScreenCapture start

    • Scanning the file system for Office documents (xls, xlsx, doc, docx)

Backdoor.OSX.Mokes.a IDA screenshot hexdump office file filters

The attacker controlling the C&C server is also able to define own file filters to enhance the monitoring of the file system as well as executing arbitrary commands on the system.

Just like on other platforms, the malware creates several temporary files containing the collected data if the C&C server is not available.

  • $TMPDIR/ss0-DDMMyy-HHmmss-nnn.sst (Screenshots)
  • $TMPDIR/aa0-DDMMyy-HHmmss-nnn.aat (Audiocaptures)
  • $TMPDIR/kk0-DDMMyy-HHmmss-nnn.kkt (Keylogs)
  • $TMPDIR/dd0-DDMMyy-HHmmss-nnn.ddt (Arbitrary Data)

DDMMyy = date: 070916 = 2016-09-07
HHmmss = time: 154411 = 15:44:11
nnn = milliseconds

If the environment variable $TMPDIR is not defined, “/tmp/” is used as the location (

Hints from the author

The author of this malware again left some references to the corresponding source files:

Backdoor.OSX.Mokes.a IDA screenshot Source file references


We detect this type of malware as HEUR:Backdoor.OSX.Mokes.a



$HOME/LibraryApp Store/storeuserd


Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A