Contagious Interview + OtterCookie: DPRK Trojanized macOS Installers Expand Beyond Developer Workflows — OTX Pulse Detection Pack

---
title: OtterCookie / Contagious Interview Trojanized macOS Installer Execution
id: 7a3f1c2e-9b44-4d1a-8f6e-2c5d8e91a001
description: Detects execution of hidden or unsigned executables nested inside .app bundles and quarantined DMG/PKG installer artifacts associated with the DPRK Contagious Interview campaign (OtterCookie).
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: macos
  service: null
detection:
  selection_img:
    Image|contains:
      - '/Contents/MacOS/'
      - '/Contents/Resources/'
      - '/Volumes/'
  selection_cli:
    CommandLine|contains:
      - 'The Unarchiver'
      - 'Sketch'
      - 'Bartender'
      - '.app/Contents/MacOS/'
  filter_signed:
    Signed: 'true'
  condition: selection_img and selection_cli and not filter_signed
falsepositives:
  - Legitimate cracked/self-signed software installations (investigate provenance)
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
date: 2026/10/04
modified: 2026/10/04
---
title: OtterCookie C2 or Staging Communication to Contagious Interview Infrastructure
id: 7a3f1c2e-9b44-4d1a-8f6e-2c5d8e91a002
description: Detects network connections to known Contagious Interview distribution/C2 domain (pobelstudio.com) including requests from scripting runtimes consistent with OtterCookie's JavaScript-based beaconing.
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: network_connection
  product: macos
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'pobelstudio.com'
  selection_initiated:
    Initiated: 'true'
  condition: all of selection_*
falsepositives:
  - Threat research sandboxes (scope exclusions to lab VLANs)
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
date: 2026/10/04
modified: 2026/10/04
---
title: Suspicious LaunchAgent/LaunchDaemon Persistence Creation on macOS
id: 7a3f1c2e-9b44-4d1a-8f6e-2c5d8e91a003
description: Detects creation or modification of LaunchAgents/LaunchDaemons plist files by non-Apple processes, consistent with OtterCookie/Contagious Interview persistence behavior.
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: file_event
  product: macos
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '/Library/LaunchDaemons/'
      - 'Library/LaunchAgents/'
    TargetFilename|endswith: '.plist'
  filter_apple:
    Image|contains:
      - '/usr/libexec/'
      - '/System/Library/'
    Image|startswith: 'com.apple.'
  condition: selection_path and not filter_apple
falsepositives:
  - Enterprise MDM enrollment, legitimate third-party updaters (Google Keystone, Microsoft AutoUpdate)
level: medium
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1543.001
  - attack.t1543.004
date: 2026/10/04
modified: 2026/10/04

// Contagious Interview / OtterCookie hunt — Microsoft Sentinel
// 1) Network connections to known C2/distribution domain
let C2Domains = dynamic(["pobelstudio.com"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (C2Domains) or RemoteUrl contains "pobelstudio"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
// 2) Trojanized installer execution from Downloads/mounted DMGs
let ProcHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine has_any ("The Unarchiver", "Bartender", "Sketch")
   and (ProcessCommandLine has_any ("/Volumes/", "~/Downloads", "/tmp/", ".app/Contents/MacOS/"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
// 3) Known-bad SHA256 sweep
let BadHashes = dynamic([
  "01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b",
  "08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9",
  "0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39",
  "0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab",
  "0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29",
  "1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91",
  "24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf"
]);
let HashHits = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 has_any (BadHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ActionType;
union NetHits, ProcHits, HashHits
| sort by TimeGenerated desc

#!/bin/bash
# Contagious Interview / OtterCookie macOS IOC Hunt — run via MDM (Jamf/Intune) or locally with sudo
# Checks for trojanized installer hashes, C2 connections, and suspicious persistence artifacts.

BAD_HASHES=(
  "01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b"
  "08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9"
  "0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39"
  "0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab"
  "0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29"
  "1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91"
  "24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf"
)
C2_DOMAIN="pobelstudio.com"
REPORT="/tmp/contagious_interview_hunt_$(date +%Y%m%d_%H%M%S).txt"
echo "=== Contagious Interview / OtterCookie Hunt — $(hostname) — $(date) ===" | tee "$REPORT"

echo -e "\n[1] Hash sweep of Downloads, /tmp, /Applications for known-bad SHA256..." | tee -a "$REPORT"
find ~/Downloads /tmp /Applications -type f \( -name "*.dmg" -o -name "*.pkg" -o -name "*.app" -o -type f \) 2>/dev/null | while read -r f; do
  h=$(shasum -a 256 "$f" 2>/dev/null | awk '{print $1}')
  for bad in "${BAD_HASHES[@]}"; do
    if [[ "$h" == "$bad" ]]; then
      echo "[ALERT] MALICIOUS HASH: $f ($h)" | tee -a "$REPORT"
    fi
  done
done

echo -e "\n[2] Checking active/recent connections to C2 domain..." | tee -a "$REPORT"
lsof -i 2>/dev/null | grep -i "$C2_DOMAIN" | tee -a "$REPORT"
log show --last 24h --predicate 'eventMessage CONTAINS "pobelstudio"' 2>/dev/null | head -20 | tee -a "$REPORT"

echo -e "\n[3] Auditing LaunchAgents/LaunchDaemons for non-Apple persistence..." | tee -a "$REPORT"
for dir in ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons; do
  if [[ -d "$dir" ]]; then
    for plist in "$dir"/*.plist; do
      [[ -e "$plist" ]] || continue
      label=$(/usr/libexec/PlistBuddy -c "Print :Label" "$plist" 2>/dev/null)
      if [[ "$label" != com.apple.* ]]; then
        echo "[REVIEW] $plist (Label: $label)" | tee -a "$REPORT"
        /usr/libexec/PlistBuddy -c "Print :ProgramArguments" "$plist" 2>/dev/null | tee -a "$REPORT"
      fi
    done
  fi
done

echo -e "\n[4] Checking for unsigned/modified installs of impersonated apps..." | tee -a "$REPORT"
for app in "/Applications/The Unarchiver.app" "/Applications/Sketch.app" "/Applications/Bartender 5.app" "/Applications/Bartender 4.app"; do
  if [[ -d "$app" ]]; then
    sig=$(codesign -dv "$app" 2>&1 | grep -E "Authority|Signature" | head -2)
    spctl_out=$(spctl -a -vv "$app" 2>&1)
    echo "[APP] $app" | tee -a "$REPORT"
    echo "  $sig" | tee -a "$REPORT"
    echo "  Gatekeeper: $spctl_out" | tee -a "$REPORT"
  fi
done

echo -e "\n=== Hunt complete. Results: $REPORT ==="