Vidar Stealer, Overlord RAT & MacSync: Cross-Platform Credential Theft Campaign — OTX Pulse Detection Pack

---
title: Vidar Stealer / Factory-v3 Go Loader Execution via Cracked Software Lure
id: 7f3a1c2e-8b4d-4e9a-a1c5-vidar000001
status: experimental
description: Detects execution of password-protected archive contents and Go loader behavior associated with the Vidar/XMRig (X3D MINER) malvertising campaign, including file-inflated binaries and XMRig deployment.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
  - https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_archive:
    ParentImage|endswith:
      - '\7z.exe'
      - '\7zg.exe'
      - '\winrar.exe'
      - '\rar.exe'
  selection_suspicious_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\AppData\Roaming\'
  selection_xmrig:
    CommandLine|contains:
      - '--donate-level'
      - 'stratum+tcp'
      - 'xmrig'
      - '--coin'
      - 'randomx'
  condition: (selection_parent_archive and selection_suspicious_path) or selection_xmrig
falsepositives:
  - Legitimate cryptocurrency mining (rare in enterprise environments)
  - Software developers extracting build artifacts from archives
level: high
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059
  - attack.impact.t1496
---
title: macOS LaunchAgent Persistence - Overlord RAT / Fake Zoom Installer
id: 8a4b2d3f-9c5e-5f0b-b2d6-overlord0002
status: experimental
description: Detects creation of LaunchAgent plist files by suspicious processes, matching Overlord RAT persistence behavior delivered via the fake ZoomMeetings installer campaign.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
  - https://www.jamf.com/blog/fake-zoom-installer-delivers-overlord-rat-macos/
logsource:
  product: macos
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '~/Library/LaunchAgents/'
  selection_suspicious_writer:
    Image|contains:
      - '/tmp/'
      - '/private/tmp/'
      - '/var/folders/'
      - 'Downloads'
  filter_legitimate:
    Image|endswith:
      - '/softwareupdated'
      - '/Installer'
      - '/packagekitd'
  condition: selection_path and selection_suspicious_writer and not filter_legitimate
falsepositives:
  - Legitimate third-party software installation creating LaunchAgents
  - MDM enrollment agents
level: high
tags:
  - attack.persistence
  - attack.t1543.001
  - attack.t1543
---
title: ClickFix Fake CAPTCHA Terminal Execution - MacSync Stealer
id: 9b5c3e4a-0d6f-6a1c-c3e7-macsync00003
status: experimental
description: Detects the ClickFix social engineering pattern where users are tricked into pasting and executing malicious commands in Terminal, as used by the MacSync macOS crypto-draining campaign. Flags curl/osascript download-and-execute chains from Terminal.app or iTerm.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
  - https://www.huntress.com/blog/mac-crypto-draining-malware
logsource:
  product: macos
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/Terminal.app/Contents/MacOS/Terminal'
      - '/iTerm2'
      - '/zsh'
      - '/bash'
  selection_download_exec:
    CommandLine|contains:
      - 'curl'
      - 'base64 -d'
      - ' | bash'
      - ' | sh'
      - ' | zsh'
      - 'osascript -e'
  selection_ip_url:
    CommandLine|contains:
      - 'http://1'
      - 'http://19'
      - 'https://1'
      - '.sh'
      - '/MachO'
  condition: selection_parent and selection_download_exec and selection_ip_url
falsepositives:
  - Developer install scripts (Homebrew, nvm) - tune with known-good URL allowlist
  - IT provisioning scripts
level: critical
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059.004
  - attack.t1105

// Security Arsenal — OTX Pulse Hunt: Vidar / Overlord RAT / MacSync
// Hunts network IOCs, Zoom-impersonation domains, ClickFix patterns, and XMRig C2
let lookback = 14d;
let ioc_ips = dynamic(["179.61.227.46", "138.124.118.69", "193.29.224.151"]);
let ioc_domains = dynamic(["hub.zoom.com.lv", "hub.zoom.com.kg"]);
let ioc_sha256 = dynamic([
    "03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7",
    "6b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b5",
    "b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756",
    "68ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d25",
    "b9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329b",
    "2c0bb97632bb9b90ee97be2ac350a557b08d84a7dad1f3ef63ffd83be1ab1f00",
    "527f730d4ed6e9e23a971081f9e06691ac6e980bd06bb0b5f1091051d4631c5d",
    "5334c468f0ffd5899a949ac3e0bc4665f80c658cb46e1a972df4e4ba0bb905f8",
    "7878031f2bd907e7300133b3e8ce640f3cdcba56686eaca3539d4c22773bc233",
    "7a2318127cabf28552a8aeed14a8445c8f36fbda5e57d8b122cf6f1c6b51a522",
    "5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52",
    "619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5",
    "b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3",
    "f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0"
]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteIP in (ioc_ips) or RemoteUrl has_any (ioc_domains)
    | extend DetectionType = "Network IOC (C2)"),
    (DeviceFileEvents
    | where TimeGenerated > ago(lookback)
    | where SHA256 in (ioc_sha256)
    | extend DetectionType = "File Hash IOC"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where SHA256 in (ioc_sha256)
    | extend DetectionType = "Malicious Process Execution"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("stratum+tcp", "xmrig", "--donate-level", "randomx")
    | extend DetectionType = "XMRig Cryptominer Command Line"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName in~ ("Terminal", "iTerm2", "zsh", "bash")
    | where ProcessCommandLine has_all ("curl", "| ") and ProcessCommandLine has_any ("bash", "sh", "zsh", "base64 -d")
    | extend DetectionType = "ClickFix Terminal Download-Execute (MacSync)"),
    (DeviceFileEvents
    | where TimeGenerated > ago(lookback)
    | where FolderPath has "Library/LaunchAgents/" and FolderPath endswith ".plist"
    | where InitiatingProcessFolderPath has_any ("/tmp/", "/private/tmp/", "/var/folders/", "Downloads")
    | extend DetectionType = "Suspicious LaunchAgent Creation (Overlord RAT)")
| project TimeGenerated, DeviceName, DetectionType, FileName, FolderPath, SHA256,
          ProcessCommandLine, RemoteIP, RemoteUrl, InitiatingProcessFileName, AccountName
| sort by TimeGenerated desc

#!/bin/bash
# Security Arsenal — macOS IOC Hunt Script
# Targets: Overlord RAT (fake Zoom installer) and MacSync (ClickFix) artifacts
# Run with sudo on suspected macOS endpoints. Output: /tmp/sa_ioc_hunt_<hostname>.log

LOG="/tmp/sa_ioc_hunt_$(hostname -s).log"
exec > >(tee -a "$LOG") 2>&1
echo "=== Security Arsenal macOS IOC Hunt — $(date) ==="

echo ""
echo "[1] Known malicious file hashes (SHA256)"
declare -a HASHES=(
  "2c0bb97632bb9b90ee97be2ac350a557b08d84a7dad1f3ef63ffd83be1ab1f00"
  "527f730d4ed6e9e23a971081f9e06691ac6e980bd06bb0b5f1091051d4631c5d"
  "5334c468f0ffd5899a949ac3e0bc4665f80c658cb46e1a972df4e4ba0bb905f8"
  "7878031f2bd907e7300133b3e8ce640f3cdcba56686eaca3539d4c22773bc233"
  "7a2318127cabf28552a8aeed14a8445c8f36fbda5e57d8b122cf6f1c6b51a522"
  "5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52"
  "619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5"
  "b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3"
  "f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0"
)
find /Users /tmp /private/tmp /var/folders -type f \( -name "ZoomMeetings*" -o -name "*.sh" -o -name "*.app" \) 2>/dev/null | while read -r f; do
  h=$(shasum -a 256 "$f" 2>/dev/null | awk '{print $1}')
  for bad in "${HASHES[@]}"; do
    if [ "$h" == "$bad" ]; then echo "  [HIT] $f matches known malicious SHA256"; fi
  done
done

echo ""
echo "[2] Suspicious LaunchAgents (Overlord RAT persistence)"
for d in /Library/LaunchAgents /Library/LaunchDaemons /Users/*/Library/LaunchAgents; do
  if [ -d "$d" ]; then
    find "$d" -name "*.plist" -mtime -30 2>/dev/null | while read -r p; do
      prog=$(/usr/libexec/PlistBuddy -c "Print :ProgramArguments:0" "$p" 2>/dev/null)
      case "$prog" in
        /tmp/*|/private/tmp/*|/var/folders/*|*/Downloads/*|*ZoomMeetings*)
          echo "  [SUSPICIOUS] $p -> $prog" ;;
      esac
    done
  fi
done

echo ""
echo "[3] Connections to C2 infrastructure"
for ip in 179.61.227.46 138.124.118.69 193.29.224.151; do
  hits=$(lsof -n -i | grep "$ip" 2>/dev/null)
  [ -n "$hits" ] && echo "  [HIT] Active connection to $ip:" && echo "$hits"
done
echo "  Historical DNS lookups for Zoom-impersonation domains:"
log show --predicate 'process == "mDNSResponder"' --last 7d --style compact 2>/dev/null | grep -iE "zoom\.com\.(lv|kg)" | head -20

echo ""
echo "[4] ClickFix artifacts: shell history for curl-pipe-exec commands"
for hist in /Users/*/.zsh_history /Users/*/.bash_history; do
  [ -f "$hist" ] && grep -E "curl.*\| *(ba|z)?sh|base64 -d.*\|" "$hist" 2>/dev/null | while read -r line; do
    echo "  [SUSPICIOUS HISTORY] $hist: $line"
  done
done

echo ""
echo "[5] Unsigned/unsigned-notarized Mach-O binaries in user-writable dirs"
find /Users/*/Downloads /tmp /private/tmp -type f -perm +111 -mtime -14 2>/dev/null | while read -r b; do
  if file "$b" | grep -q "Mach-O"; then
    sig=$(codesign -dv "$b" 2>&1)
    echo "$sig" | grep -q "code object is not signed" && echo "  [UNSIGNED] $b"
  fi
done

echo ""
echo "=== Hunt complete. Review $LOG and escalate any [HIT]/[SUSPICIOUS] findings. ==="