A Journey into Reversing RustBucket on macOS

The talk opens with the North Korean Lazarus group and its BlueNoroff subgroup, which runs financially motivated campaigns against crypto firms and banks and often wins targets' trust through fake job or business approaches. The speakers explain how RustBucket came to light: not from a customer endpoint, but from an unsigned, unnotarized compiled AppleScript app found on VirusTotal while hunting for generic curl-in-AppleScript patterns.

To trace the malware's behavior, they introduce SpriteTree, a Swift and SpriteKit tool that visualizes macOS process trees from es_logger captures, with a timeline slider and coloring by responsible process. Running the first stage showed it downloading a second app that showed a PDF viewer and did little else. Pivoting on a shared XOR key led them to PDF files, and then to one that unlocked the download-and-execute routine. The third stage is a Rust binary, and the speakers walk through its static linking, mangled symbols, and crate fingerprints, which they used to estimate a late-2022 development window. They also map its check-in protocol, including the POST data prefixes and command bytes the server uses.

To confirm their understanding, they built a custom C2 server in Rust that served the payload, logged check-ins, tasked the malware to launch calculator, and then terminated it. The practical takeaways are network detections based on the structure of POST data and the value of process-tree views for hunting macOS threats.