macos malware runonly applescripts avoid detection

Interestingly, there are two URLs that were returned. The first request to budaybu100001com:8080 returns the second-stage URL embedded in the string “-=-=-=” as a marker. The Network Tab shows multiple C2 connections.

Now we can dig deeper into each of these characteristics. From the Overview Tab, we can see the main behaviors of the sample including network connectivity, file dropping behavior, and system information gathering. Straight away, we see that a number of VMRay Threat Identifier (VTI) rules hit and the sample is classified as malicious. The “com.apple.4V.plist” file is placed in ~/Library/LaunchAgents by the original dropper and disguised as a Property list configuration file (PLIST) while it is in fact a compiled AppleScript. Note, at the time of analysis this sample of OSAMiner had a 2/60 detection rate on VirusTotal. In this Malware Analysis Spotlight, we will showcase the key behaviors identified during the dynamic analysis. We analyzed one of the latest samples “ com.apple.4V.plist” using VMRay Analyzer. In 2020, the SentinelLabs Team discovered that the malware authors were evolving their evasion techniques, adding more complexity by embedding one run-only AppleScript inside another. The authors of macOS.OSAMiner used run-only AppleScripts which made attempts at further analysis more difficult. This week the team at SentinelLabs released an in-depth analysis of macOS.OSAMiner, a Monero mining trojan infecting macOS users since 2015.

Macos malware runonly applescripts avoid detection