Heartbreaker: Undetected macOS Rust Ransomware with Hard-Coded AES Key and Self-Rebuilding Metamorphic Engine

Linha do tempo

1. objective-see.org ↗ · pub. 17/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

   Heartbreaker: Undetected macOS Rust Ransomware with Hard-Coded AES Key and Self-Rebuilding Metamorphic Engine

   ler a análise desta fonte ocultar

   Objective-See analyzed Heartbreaker, a previously unknown macOS ransomware sample (ad hoc-signed ARM64 Mach-O written in Rust). It was uploaded to VirusTotal in May 2025 and remains undetected by all AV engines. It was found by researcher Megan Carney. It encrypts files in ~/Downloads with AES-256-GCM, renames them to .heartbreaker, drops a README.txt ransom note demanding 0.003 BTC, and persists via a LaunchAgent. Its notable feature is a metamorphic mechanism: the binary embeds its own Rust source, mutates it, recompiles it with cargo, and replaces itself. The author assesses it as unlikely to be a major real-world threat, but a useful research specimen. The behavior-based, open-source tool RansomWhere? detected and suspended it without any signature.

   Technical Details

   • Encryption: each file is read into memory, encrypted with AES-256-GCM using a single hard-coded 32-byte key (the same for every file and presumably every victim) and a random 12-byte nonce, then truncated and overwritten. The layout is 12-byte nonce || ciphertext || 16-byte GCM tag. The author wrote a Python decryptor that recovers files without paying. The ransom window's "Decrypt Files" button does not work.
   • Scope limits: it targets only files under ~/Downloads, has no awareness of macOS privacy protections, and skips files already carrying the .heartbreaker extension.
   • Persistence: mimicore::add_to_startup() creates ~/Library/LaunchAgents/com.network.startup.plist (label com.myapp.startup, RunAtLoad) pointing at the running binary. The return value is ignored, so a failure does not stop encryption.
   • Metamorphism: rewrite() uses include_str! to embed main.rs and build.rs, rebuilds a Cargo.toml, and calls mimicore::morph(). The routine removes previously generated junk code, randomizes r_-prefixed identifiers, inserts 15 new junk func_* functions, and shuffles function order between METAMORPHIC_MARKER_START and METAMORPHIC_MARKER_END. It then builds with cargo build --release and swaps the new binary in via a .tmp rename. Each generation embeds the new source, so the cycle can repeat. If Rust is missing, the malware tries to install it.
   • Lineage: the mimicore GitHub repository is no longer available. The public metacore repository by the same author shares APIs, markers and design, and even retains a sudo ./heartbreaker error message. This does not definitively prove a rename or direct lineage.
   • Detection: RansomWhere? uses Endpoint Security modified-file close events and entropy analysis to spot untrusted processes rapidly producing high-entropy files. It suspends the process and alerts the user regardless of binary hash changes. Limitations noted: the heuristic is reactive (some files may be encrypted before the threshold is hit), and slow encryption, trusted child processes or tiny files could evade it.

   Remediation

   • Use behavior-based detection (Endpoint Security, entropy-based monitoring such as RansomWhere?) rather than hash or static signatures alone.
   • Maintain layered defenses, least privilege and reliable offline backups.
   • Hunt for the LaunchAgent com.network.startup.plist, *.heartbreaker files, and unexpected Rust/cargo installation or builds on endpoints.
   • Files encrypted by this sample can be recovered using the embedded static key and the described AES-GCM layout.