Malware

OSX/Proton.B

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

According to the HandBrake advisory, Mirror Download Server Compromised... With access to HandBrake's mirror, they trojaned the legitimate application, meaning any user who downloaded the application would inadvertently infect themselves!

T1195.002Compromise Software Supply ChainEvidence1

"a mirror server of the popular open-source video transcoder, HandBrake, was hacked... infect macOS users by trojaning the legitimate HandBreak application"

Execution

2 techniques

T1059.004Unix ShellEvidence1

"[HBAppDelegate comrad:] executes a task via \"/bin/sh -c\""

T1204User ExecutionEvidence1

Running this code and executing the infected Handbrake application... when run, the infected Handbrake application... launches (opens) /tmp/HandBrake.app

Persistence

1 technique

T1543.001Launch AgentEvidence2

Dumping the Launch Agent plist file (fr.handbrake.activity_agent.plist), we can see the malware has been set to automatically start each time the user logs in

Privilege Escalation

1 technique

T1543.001Launch AgentEvidence2

Dumping the Launch Agent plist file (fr.handbrake.activity_agent.plist), we can see the malware has been set to automatically start each time the user logs in

Stealth

5 techniques

T1036MasqueradingEvidence2

If the user is tricked into providing a user name and password the malware will install itself (/tmp/HandBrake.app) persistently as: 'activity_agent.app'.

T1070.001Clear Windows Event LogsEvidence1

"sudo -S rm -rf /var/log/* /Library/Logs/*"

T1140Deobfuscate/Decode Files or InformationEvidence1

"unzips ... HBPlayerHUDMainController.nib ... password protected zip" and "This file is loaded into memory and then decrypted via ... RNDecryptor"

T1497.001System ChecksEvidence1

"pgrep -x activity_agent... this is how the malware installer checks if the persistent component... has already been installed" and "it checks if [LittleSnitch/Radio Silence/HandsOff] exist on disk, and if so, the malware immediately exits"

T1622Debugger EvasionEvidence1

"OSX/Proton.B contains some (basic) anti-debugging logic... (dlsym(..., \"ptrace\"))(0x1f...)"

Credential Access

2 techniques

T1056Input CaptureEvidence1

Once the /tmp/HandBrake.app is launched, it displays a (fake) authentication popup - which is how the malware attempts to elevate its privileges

T1056.002GUI Input CaptureEvidence1

"displays a fake authentication prompt... If the user is tricked into entering their password, the malware 'validates' the credentials via... echo '%@' | sudo -S"

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

"nc -G 20 -z 8.8.8.8 53 ..." and "ping -c 1 handbrake.biz ..."

T1497.001System ChecksEvidence1

T1622Debugger EvasionEvidence1

"OSX/Proton.B contains some (basic) anti-debugging logic... (dlsym(..., \"ptrace\"))(0x1f...)"

Collection

5 techniques

T1056Input CaptureEvidence1

Once the /tmp/HandBrake.app is launched, it displays a (fake) authentication popup - which is how the malware attempts to elevate its privileges

T1056.002GUI Input CaptureEvidence1

"displays a fake authentication prompt... If the user is tricked into entering their password, the malware 'validates' the credentials via... echo '%@' | sudo -S"

T1113Screen CaptureEvidence1

"screencapture -x %@/scr%@.png"

T1560Archive Collected DataEvidence1

binary=/usr/bin/unzip args: "-P", "qzyuzacCELFEYiJ52mhjEC7HYl4eUPAR1EEf63oQ5iTkuNIhzRk2JUKF4IXTRdiQ", "/Volumes/HandBrake/HandBrake.app/Contents/Resources/HBPlayerHUDMainController.nib", "-d", "/tmp"

T1560.001Archive via UtilityEvidence1

"zip ... Chrome ... Cookies ..." and "zip -r ... Keychains ... 1Password ... ~/.gnupg"

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

"decode... addresses of its command and control servers" and "https://%@/api/upload" and "curl -s ... https://handbrake.biz/rsa"

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

"https://%@/api/upload" and commands to zip browser/keychain/1Password data prior to upload

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

"killall Console; killall Wireshark"

INDICATORS OF COMPROMISE

IOCs tracked for this family

18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

objective seeNews

May 10, 2017

OSX/Proton.B

macOS malware delivered via a trojaned HandBrake app. It installs persistence as a LaunchAgent (fr.handbrake.activity_agent / activity_agent), performs anti-debugging (ptrace PT_DENY_ATTACH), contacts multiple C2 domains, prompts the user for their password via a fake “install additional codecs” dialog to gain sudo/root, and can collect/exfiltrate sensitive data (Keychains, browser credential stores, 1Password, GnuPG, screenshots). It also attempts defense evasion by killing tools (Console/Wireshark) and wiping logs.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching18

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

OSX/Proton.B

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

T1195.002Compromise Software Supply ChainEvidence1

"a mirror server of the popular open-source video transcoder, HandBrake, was hacked... infect macOS users by trojaning the legitimate HandBreak application"

Execution

2 techniques

T1059.004Unix ShellEvidence1

"[HBAppDelegate comrad:] executes a task via \"/bin/sh -c\""

T1204User ExecutionEvidence1

Running this code and executing the infected Handbrake application... when run, the infected Handbrake application... launches (opens) /tmp/HandBrake.app

Persistence

1 technique

T1543.001Launch AgentEvidence2

Dumping the Launch Agent plist file (fr.handbrake.activity_agent.plist), we can see the malware has been set to automatically start each time the user logs in

Privilege Escalation

1 technique

T1543.001Launch AgentEvidence2

Dumping the Launch Agent plist file (fr.handbrake.activity_agent.plist), we can see the malware has been set to automatically start each time the user logs in

Stealth

5 techniques

T1036MasqueradingEvidence2

If the user is tricked into providing a user name and password the malware will install itself (/tmp/HandBrake.app) persistently as: 'activity_agent.app'.

T1070.001Clear Windows Event LogsEvidence1

"sudo -S rm -rf /var/log/* /Library/Logs/*"

T1140Deobfuscate/Decode Files or InformationEvidence1

"unzips ... HBPlayerHUDMainController.nib ... password protected zip" and "This file is loaded into memory and then decrypted via ... RNDecryptor"

T1497.001System ChecksEvidence1

T1622Debugger EvasionEvidence1

"OSX/Proton.B contains some (basic) anti-debugging logic... (dlsym(..., \"ptrace\"))(0x1f...)"

Credential Access

2 techniques

T1056Input CaptureEvidence1

Once the /tmp/HandBrake.app is launched, it displays a (fake) authentication popup - which is how the malware attempts to elevate its privileges

T1056.002GUI Input CaptureEvidence1

"displays a fake authentication prompt... If the user is tricked into entering their password, the malware 'validates' the credentials via... echo '%@' | sudo -S"

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

"nc -G 20 -z 8.8.8.8 53 ..." and "ping -c 1 handbrake.biz ..."

T1497.001System ChecksEvidence1

T1622Debugger EvasionEvidence1

"OSX/Proton.B contains some (basic) anti-debugging logic... (dlsym(..., \"ptrace\"))(0x1f...)"

Collection

5 techniques

T1056Input CaptureEvidence1

Once the /tmp/HandBrake.app is launched, it displays a (fake) authentication popup - which is how the malware attempts to elevate its privileges

T1056.002GUI Input CaptureEvidence1

"displays a fake authentication prompt... If the user is tricked into entering their password, the malware 'validates' the credentials via... echo '%@' | sudo -S"

T1113Screen CaptureEvidence1

"screencapture -x %@/scr%@.png"

T1560Archive Collected DataEvidence1

binary=/usr/bin/unzip args: "-P", "qzyuzacCELFEYiJ52mhjEC7HYl4eUPAR1EEf63oQ5iTkuNIhzRk2JUKF4IXTRdiQ", "/Volumes/HandBrake/HandBrake.app/Contents/Resources/HBPlayerHUDMainController.nib", "-d", "/tmp"

T1560.001Archive via UtilityEvidence1

"zip ... Chrome ... Cookies ..." and "zip -r ... Keychains ... 1Password ... ~/.gnupg"

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

"decode... addresses of its command and control servers" and "https://%@/api/upload" and "curl -s ... https://handbrake.biz/rsa"

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

"https://%@/api/upload" and commands to zip browser/keychain/1Password data prior to upload

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

"killall Console; killall Wireshark"

INDICATORS OF COMPROMISE

IOCs tracked for this family

18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

objective seeNews

May 10, 2017

OSX/Proton.B

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching18

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.