Methusela Cebrian Ferrer Microsoft
The increasing reliance on the global inter-connectivity of devices, data and people brings a new and ever-changing set of security challenges. For instance, malicious and potentially unwanted tools are widely available - relatively easy to acquire and weaponize. However, a more tempting target may lie in the rich opportunity of data and information stored and shared in connected digital space.
Apple Mac OS X and iOS users are not isolated in this case; in fact, in recent years, we have discussed how these platforms are affected and how they share the same security concerns. However, investigating and conducting analysis of malicious code can be very challenging on Apple devices, due to the fact that there is limited published research in this field.
There is a host of malware detection and malware analysis software solutions that have evolved to counter persistent network threats. In this post, we look at the types of tools available (SIM, SEM, & SIEM), and we review the six best malware detection tools to help you decide which one is right for your network. Volume 0x1: Analysis Starting with introductory topics such as infection vectors, persistence mechanisms, and payloads, this content-packed volume also covers in detail, the tools & techniques needed to comprehensively analyze malware targeting Apple's desktop OS.
This paper proposes to discuss how to set up a multi-user threat research lab environment for these platforms. The study includes an evaluation of available and open-source tools for the purpose of identifying, dissecting and monitoring malicious behaviour, examining why they are useful, and detailing relevant system artifacts - files and directories where users' valuable data and information are stored. It provides analysis of real threats from the wild as examples to emphasize the utility of static and dynamic analysis. Furthermore, it outlines the limitations and provides recommended options for users to consider. Overall, this paper aims to provide useful guidance and a starting point for individuals and the research community who may be pursuing an interest in malware on this platform.
A cryptocurrency mining campaign targeting macOS is using malware that has evolved into a complex variant giving researchers a lot of trouble analyzing it.
The malware is tracked as OSAMiner and has been in the wild since at least 2015. Yet, analyzing it is difficult because payloads are exported as run-only AppleScript files, which makes decompiling them into source code a tall order.
A recently observed variant makes analyzing even more difficult as it embeds a run-only AppleScript into another scripts and uses URLs in public web pages to download the actual Monero miner.
Reversing run-only AppleScript
OSAMiner typically spreads via pirated copies of games and software, League of Legends and Microsoft Office for macOS being among the more popular examples.
The malware has been researched in the past [1, 2] but the run-only AppleScript file hindered full analysis, limiting it to observing the behavior of the sample.
Malware Analysis Tool For Mac Osx
AppleScript files include both the source and the compiled code but enabling 'run-only' saves only the compiled version so the human-readable code is no longer available, thus removing the possibility of reverse engineering.
Security researchers at SentinelOne discovered at the end of 2020 a new sample of OSAMiner that complicated 'the already difficult process of analysis.'
However, they were able to reverse engineer some samples they collected by using a less-known AppleScript disassembler (Jinmo’s applescript-disassembler) and a decompiler tool developed internally called aevt_decompile.
Evasion actions
The recent OSAMiner campaigns use three run-only AppleScript files to deploy the mining process on the infected macOS machine, SentinelOne found:
- a parent script that executes from the trojanized application
- an embedded script
- the miner setup AppleScript
The main role of the parent script is to write the embedded AppleScript to ~/Library/k.plist using a 'do shell script' command and execute it. It also checks if the machine has enough free space and exits if there isn't sufficient storage.
Other tasks it runs include collecting the serial number of the device, restarting the 'launchctl' job responsible for loading and unloading daemons or agents, and to kill the Terminal application.
The researchers say that the main script also sets up a persistence agent and downloads the first stage of the miner from a URL set on a public page.
Some samples may not lead to a live URL. However, SentinelOne was able to find an active one (https://www[.]emoneyspace[.]com/wodaywo) and noticed that the malware parsed a link in the source code of the page that pointed to a PNG image.
This was the third run-only AppleScript, downloaded to the ~/Library/11.PNG. Its purpose is to download the open-source XMR-Stak Monero miner that works on Linux, Windows, and macOS.
Malware Analysis Tool For Mac Download
'The setup script includes pool address, password and other configuration information but no wallet address,' the researchers say in a report today, adding that it also uses the 'caffeinate' tool to prevent the machine from entering sleep mode.
Evading detection
According to SentinelOne, the second script is intended to prevent analysis and evade detection. Supporting this conclusion is killing the Activity Monitor, which is the equivalent of the Task Manager in Windows, likely to prevent users from checking the system's resource usage.
Furthermore, the script is designed to kill processes belonging to popular tools for system monitoring and cleaning. It finds them by checking a hardcoded list.
SentinelOne says that while AppleScript incorporates more powerful features [1, 2], the authors of OSAMiner are not currently taking advantage. This is likely because the current setup allowed them to run their cryptocurrency mining campaigns with little resistance from the security community.
Malware Analysis Tool For Mac Shortcut
However, as SentinelOne proved, the technique is not infallible and researchers have the means to analyze it and prepare defenses against other malware that may choose to use it.
Malware Analysis Tool For Mac Os
Related Articles: