New Tool Sheds Light on AppleScript-Obfuscated Malware

guest · Jan 12, 2021

New Tool Sheds Light on AppleScript-Obfuscated Malware
January 11, 2021
https://www.darkreading.com/threat-...applescript-obfuscated-malware/d/d-id/1339870

An effort to reverse-engineer malicious AppleScript has led to the creation of a tool to analyze run-only malware targeting the Mac operating system, undermining a common attacker approach to obfuscating code on the platform.

Cybersecurity firm SentinelOne created the tool, known as the Apple Event (AEVT) decompiler, to analyze a cryptominer campaign that used AppleScript to automated four different stages of the infection chain: a persistence agent, a main script, an anti-analysis script, and a setup script. The AppleScripts used to automate each task were compiled as run-only code, which removes much of the contextual signposts used by static analysis, the SentinelOne analysis states.
Click to expand...

OSAMiner, the program analyzed by SentinelOne researchers using the new AEVT decompiler, has likely escaped notice because of its ability to evade analysis using run-only AppleScripts, he says. The OSAMiner campaign has likely existed for at least five years, he says.
Click to expand...

SentinelOne: FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts

macOS.OSAMiner is a cryptominer campaign that has resisted full researcher analysis for at least five years due to its use of multiple run-only AppleScripts.

Combining a public AppleScript disassembler repo with our own AEVT decompiler tool allowed us to statically reverse run-only AppleScripts for the first time and reveal previously unknown details about the campaign and the malware’s architecture.

We have released our AEVT decompiler tool as open source to aid other researchers in the analysis of malicious run-only AppleScripts.

Click to expand...

Log in or Sign up

New Tool Sheds Light on AppleScript-Obfuscated Malware

guest Guest

Log in or Sign up

New Tool Sheds Light on AppleScript-Obfuscated Malware

guest Guest

Useful Searches