Dridex Returns, Targets MacOS Using New Entry Method

Figure 1. Mach-o regions which contain the header, load commands, and segments of the file

Figure 2. Detections of a.out from April 2019 to December 2022

Figure 3. Disassembly of the __DATA__data segment

Figure 4. Disassembly of how the sample writes data onto the target files

Figure 5. Disassembly of the __DATA__cstring segment

Figure 7. Text prompt showing that this document file contains macros

Figure 8. Macros contained in the overwritten .doc file that were extracted using oletools

Figure 9. Code snippet from the autoopen macro

Figure 10. Code snippet from Module1 that shows how the malware creates and executes an executable file

Figure 11. Code snippet from Module2 showing the decryption routine to connect to the encrypted URL

Figure 12. Code snippet from Module3 showing where the malware writes to the executable file

Figure 13. Network activity from the sample that shows the details of the URL it connects to

Figure 14. Payload of the sample when the macro-enabled document is opened

Figure 15. Content of the executable file dropped by the malware