Campaign Utilizes Malicious Zoom Installer to Deploy Overlord RAT on macOS and Windows
In a recent cybersecurity alert, experts unveiled a cross-platform malware campaign that cunningly disguises itself as a legitimate Zoom installer to infiltrate both macOS and Windows systems. This malicious endeavor deploys Overlord, an open-source remote access Trojan (RAT), compromising user devices while masquerading as a trusted application.
The campaign, carefully documented by Jamf, stands out due to its unique method of operation. Unlike most macOS malware projects, which often utilize programming languages like Go or Rust for broader compatibility, this particular first-stage downloader has been developed as a self-contained .NET 10 single-file application. This downloader is identified as a macOS ARM64 Mach-O binary, named "ZoomMeetings," which comes equipped with the .NET runtime bundled within.
Experts found that .NET assemblies, regardless of the operating system, conform to the Portable Executable (PE) format. In their analysis, researchers successfully extracted 34 embedded Dynamic Link Libraries (DLLs) from the binary. One such DLL was disguised with meticulously crafted metadata that mimicked an authentic Zoom installer, thereby enhancing its deceptive nature with branding that read “Zoom Communications, Inc.”
A Closer Look at the Malware’s Mechanisms
The specific variant of this malware, which was identified on VirusTotal, is described with the SHA-256 hash: 7a2318127cabf28552a8aeed14a8445c8f36fbda5e57d8b122cf6f1c6b51a52. Notably, it managed to evade detection by static antivirus engines, underscoring the sophistication of its coding. The malware’s code is heavily obfuscated, utilizing randomized identifiers and a base64-plus-XOR encryption scheme, which employs a key of 0x94. This complexity serves to obscure critical strings within the code that include URLs and infrastructure used by the attackers.
As the downloader executes, it employs .NET’s RuntimeInformation APIs to ascertain the operating system and architecture of the infected machine. Following this detection phase, it retrieves one of three tailored payloads from cdn.zoom.com[.]kg, based on whether the host is running macOS ARM64, macOS Intel, or Windows x64. Each request incorporates a randomly generated six-character token, with requests devoid of this token resulting in an HTTP 401 error.
Upon execution, the malware strategically drops the second-stage payload to /tmp/ZoomMeetings. It then initiates this payload using a background process via the nohup command, ensuring that it persists even if the parent process is terminated. Simultaneously, it downloads the legitimate Zoom installer, thereby maintaining the ruse that “Zoom Meetings Installed,” irrespective of the success of the malicious payload.
The second-phase payload is another Mach-O ARM64 binary derived from Overlord, a well-documented open-source, WebSocket-based RAT. This iteration features garble obfuscation techniques that hinder reverse engineering, successfully defeating popular decompilation tools like GoReSym. With its command-and-control (C2) hardcoded to hub.zoom.com[.]kg:5173, it notably disables TLS certificate validation to compromise secure communication channels.
Overlord is revealed to possess a range of capabilities that threaten users, including keylogging, the ability to capture screens and webcam feeds, microphone access, full filesystem control, and process management. Moreover, it facilitates the execution of multi-language scripts, remote desktop streaming, and even boasts a plugin loader for web assembly (WASM). Despite these advanced functionalities, the variant analyzed in this report relies on a hardcoded address rather than utilizing a blockchain-based command-and-control resolver.
Persistence Techniques and Attribution Concerns
The malware can achieve persistence on infected systems through a LaunchAgent, toggled by the OVERLORD_ENABLE_PERSISTENCE flag. While this flag did not activate in the primary sample examined, it was triggered in a secondary variant that deployed a LaunchAgent at ~/Library/LaunchAgents/com.zoom.plist.
It is worth mentioning that Jamf Threat Labs has observed overlaps with a malware family known as FlexibleFerret, which has been attributed to North Korean actors and was associated with the Contagious Interview campaign. The shared usage of the com.zoom LaunchAgent label indicates a potential linkage that merits further scrutiny.
The Overlord RAT has previously emerged in campaigns connected to UNK_DeadDrop, a cluster assessed by cybersecurity firm Proofpoint as likely tied to North Korean affiliations. However, as of now, Jamf has not formally associated this specific campaign with any known actor, leaving an open question about its origins.
This notable campaign marks a landmark development in the exploitation of .NET as a macOS malware downloader, placing it alongside established cross-platform options such as Go and Rust. To combat such threats effectively, Jamf strongly recommends that organizations implement robust threat prevention measures and web protection protocols to deter the execution of similar payloads in the future.
Indicators of Compromise (IOCs)
As part of their analysis, Jamf also released a detailed table of indicators of compromise. This includes domain names, file paths, and specific hashes that help define the malware’s various components and their respective operations.
In conclusion, the emergence of this sophisticated malware campaign unveils a new frontier in cybersecurity threats, highlighting the ongoing cat-and-mouse game between cybercriminals and defenders. As these attackers adopt increasingly complex techniques, relevant stakeholders must remain vigilant and adaptive to protect their assets in a digital landscape fraught with danger.