AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |
Back to Blog
Macos used runonly avoid detection for1/29/2024 The primary reason was that security researchers weren’t able to retrieve the malware’s entire code at the time, which used nested run-only AppleScript files to retrieve its malicious code across different stages.Īs users installed the pirated software, the boobytrapped installers would download and run a run-only AppleScript, which would download and run a second run-only AppleScript, and then another final third run-only AppleScript. Since “run-only” AppleScript come in a compiled state where the source code isn’t human-readable, this made analysis harder for security researchers. #MACOS MALWARE YEARS RUNONLY APPLESCRIPTS TO CODE# Yesterday, Stokes published the full-chain of this attack, along with indicators of compromise (IOCs) of past and newer OSAMiner campaigns. Stokes and the SentinelOne team hope that by finally cracking the mystery surrounding this campaign and by publishing IOCs, other macOS security software providers would now be able to detect OSAMiner attacks and help protect macOS users. #MACOS MALWARE YEARS RUNONLY APPLESCRIPTS TO SOFTWARE# “Run-only AppleScripts are surprisingly rare in the macOS malware world, but both the longevity of and the lack of attention to the macOS.OSAMiner campaign, which has likely been running for at least 5 years, shows exactly how powerful run-only AppleScripts can be for evasion and anti-analysis,” Stokes concluded in his report yesterday. “In this case, we have not seen the actor use any of the more powerful features of AppleScript that we’ve discussed elsewhere, but that is an attack vector that remains wide open and which many defensive tools are not equipped to handle.” An effort to reverse-engineer malicious AppleScript has led to the creation of a tool to analyze run-only malware targeting the Mac operating system, undermining a common. The IOCs are available in the SentinelOne OSAMiner report, here. #MACOS MALWARE YEARS RUNONLY APPLESCRIPTS TO CODE#.#MACOS MALWARE YEARS RUNONLY APPLESCRIPTS TO SOFTWARE#.
0 Comments
Read More
Leave a Reply. |