macOS恶意程序专项分析

---
name: macos-malware-analysis
description: >
  Perform macOS-specific malware analysis including Mach-O binary examination,
  persistence mechanism enumeration (LaunchAgents, LaunchDaemons, Login Items,
  kernel extensions), Gatekeeper and notarization bypass detection, Keychain
  access and credential theft investigation, code signing analysis, and sandbox
  escape technique identification. Covers family identification for XCSSET,
  Atomic Stealer, RustBucket, and Lazarus macOS tools. Use when analyzing
  suspected macOS malware samples, investigating compromised Macs, or
  responding to incidents targeting Apple endpoints.
---

# macOS Malware Analysis

Analyze macOS malware samples to understand Mach-O binary structure, identify
persistence mechanisms, detect Gatekeeper bypass techniques, assess credential
theft capabilities, and extract actionable intelligence for detection and
response.

## Prerequisites

- **Python 3.8+**: `hashlib`, `json`, `re`, `os`, `subprocess`, `plistlib` (standard library)
- **Python packages (optional)**: `lief`, `yara-python`, `macholib`
- **Tools (recommended)**: `otool`, `jtool2`, `class-dump`, `codesign`, `spctl`, Ghidra/IDA Pro, Hopper
- **System tools**: `defaults`, `plutil`, `log`, `sqlite3`, `ditto`
- **Environment**: Isolated macOS VM with snapshots (never run malware on production systems)
- **References**: Objective-See tools (KnockKnock, BlockBlock, LuLu), VirusTotal, MalwareBazaar

## Step-by-Step Instructions

### Step 1: Mach-O Binary Analysis

Examine the Mach-O binary structure to understand compilation, linking, and capabilities.

**Run initial triage:**
```bash
# File type and architecture identification
file suspicious_binary
otool -h suspicious_binary

# Check for universal/fat binary (multiple architectures)
lipo -info suspicious_binary 2>/dev/null
# If universal, extract specific architecture
lipo suspicious_binary -thin x86_64 -output suspicious_x86_64 2>/dev/null
lipo suspicious_binary -thin arm64 -output suspicious_arm64 2>/dev/null

# Load commands - reveal frameworks, libraries, and entitlements
otool -l suspicious_binary | head -200

# List linked dynamic libraries
otool -L suspicious_binary

# Check for rpath entries (potential hijacking)
otool -l suspicious_binary | grep -A2 "LC_RPATH"
```

**Disassembly and deeper inspection:**
```bash
# Disassemble text section
otool -tV suspicious_binary > disassembly.txt

# Objective-C class information (critical for macOS malware)
class-dump suspicious_binary > class_dump.txt 2>/dev/null

# Use jtool2 for enhanced analysis
jtool2 -h suspicious_binary
jtool2 --sig suspicious_binary
jtool2 -d objc suspicious_binary 2>/dev/null

# Extract strings with encoding detection
strings -a -n 6 suspicious_binary > strings_ascii.txt

# Look for embedded plists, scripts, or payloads
otool -l suspicious_binary | grep -A5 "__DATA.*__const"
```

**Run the macOS malware analyzer:**
```bash
python3 scripts/macos_malware_analyzer.py \
  --sample suspicious_binary \
  --mode macho-analysis \
  --output macho_analysis.json
```

**Detect obfuscation and anti-analysis:**
```bash
# Check for packed or encrypted binaries
otool -l suspicious_binary | grep -A4 "LC_ENCRYPTION_INFO"

# Check for anti-debugging techniques
strings suspicious_binary | grep -iE "(ptrace|PT_DENY_ATTACH|sysctl|P_TRACED|AmIBeingDebugged)"

# Check for VM detection
strings suspicious_binary | grep -iE "(VMware|VirtualBox|Parallels|hw\.model|machdep\.cpu)"

# Look for sandbox detection
strings suspicious_binary | grep -iE "(sandbox-check|sandbox_check|APP_SANDBOX)"
```

### Step 2: macOS Persistence Mechanisms

Enumerate all persistence vectors the malware may install.

**LaunchAgents and LaunchDaemons:**
```bash
# System-level LaunchDaemons (require root)
ls -la /Library/LaunchDaemons/
for plist in /Library/LaunchDaemons/*.plist; do
  echo "=== $plist ==="
  plutil -p "$plist" 2>/dev/null
done

# System-level LaunchAgents
ls -la /Library/LaunchAgents/
for plist in /Library/LaunchAgents/*.plist; do
  echo "=== $plist ==="
  plutil -p "$plist" 2>/dev/null
done

# User-level LaunchAgents (per-user persistence)
for user_home in /Users/*/; do
  la_dir="${user_home}Library/LaunchAgents"
  if [ -d "$la_dir" ]; then
    echo "=== $la_dir ==="
    ls -la "$la_dir/"
    for plist in "$la_dir"/*.plist; do
      plutil -p "$plist" 2>/dev/null
    done
  fi
done

# Check for recently modified launch items
find /Library/Launch* ~/Library/LaunchAgents -name "*.plist" -mtime -30 -ls 2>/dev/null
```

**Login Items:**
```bash
# Check Login Items via defaults
osascript -e 'tell application "System Events" to get the name of every login item' 2>/dev/null

# Check backgroundtaskmanagementagent database (macOS 13+)
sqlite3 ~/Library/Application\ Support/com.apple.backgroundtaskmanagementagent/BackgroundItems-v*.btm \
  "SELECT * FROM item_info;" 2>/dev/null

# Check the legacy loginwindow plist
defaults read com.apple.loginwindow LoginHook 2>/dev/null
defaults read com.apple.loginwindow LogoutHook 2>/dev/null

# Service Management Framework items
sfltool dumpbtm 2>/dev/null
```

**Kernel Extensions (kexts):**
```bash
# List loaded kernel extensions
kextstat | grep -v "com.apple"

# Check third-party kexts
ls -la /Library/Extensions/
ls -la /System/Library/Extensions/ | grep -v "com.apple"

# Check for recently installed kexts
find /Library/Extensions -name "*.kext" -mtime -30 -ls 2>/dev/null
```

**Profile and configuration persistence:**
```bash
# Check for configuration profiles (MDM-style persistence)
profiles list -verbose 2>/dev/null

# Check periodic scripts
ls -la /etc/periodic/daily/ /etc/periodic/weekly/ /etc/periodic/monthly/ 2>/dev/null

# Check cron (still works on macOS)
crontab -l 2>/dev/null
ls -la /var/at/tabs/ 2>/dev/null

# Check Authorization Plugins (advanced persistence)
ls -la /Library/Security/SecurityAgentPlugins/ 2>/dev/null

# Check Directory Services plugins
ls -la /Library/DirectoryServices/PlugIns/ 2>/dev/null
```

**Run persistence scan:**
```bash
python3 scripts/macos_malware_analyzer.py \
  --mode persistence \
  --output persistence_findings.json
```

### Step 3: Gatekeeper and Notarization Bypass Analysis

Detect techniques used to circumvent macOS security mechanisms.

**Gatekeeper status and bypass checks:**
```bash
# Check Gatekeeper status
spctl --status

# Assess the sample against Gatekeeper
spctl --assess --verbose suspicious_binary 2>&1
spctl --assess --verbose --type execute suspicious_binary 2>&1

# Check quarantine attribute (com.apple.quarantine)
xattr -l suspicious_binary 2>/dev/null
xattr -p com.apple.quarantine suspicious_binary 2>/dev/null

# Check if quarantine was stripped (common bypass)
# Missing quarantine xattr on a downloaded file indicates bypass
mdls -name kMDItemWhereFroms suspicious_binary 2>/dev/null
```

**Notarization verification:**
```bash
# Check notarization ticket
stapler validate suspicious_binary 2>&1
codesign --test-requirement="=notarized" --verify suspicious_binary 2>&1

# Check if notarization was revoked
spctl --assess --verbose=4 --type execute suspicious_binary 2>&1
```

**Common bypass techniques to look for:**
```bash
# Check for quarantine removal in scripts
strings suspicious_binary | grep -iE "(xattr.*-d.*quarantine|xattr.*-c|removeAllAttributes)"

# Check for bypass via archive handling (DMG, ISO, ZIP exploitation)
strings suspicious_binary | grep -iE "(hdiutil|diskutil|mount|\.dmg|\.iso)"

# Check for AppleScript-based bypass
strings suspicious_binary | grep -iE "(osascript.*-e|do shell script|with administrator)"

# Check for symlink/hardlink abuse to bypass Gatekeeper
strings suspicious_binary | grep -iE "(symlink|ln\s+-s|link\s+)"
```

### Step 4: Keychain Access and Credential Theft

Investigate credential theft capabilities targeting macOS Keychain and other stores.

**Keychain access analysis:**
```bash
# Check for Keychain API usage
strings suspicious_binary | grep -iE "(SecKeychain|SecItem|kSecClass|kSecAttr|kSecValue|SecAccess)"

# Check for security command-line tool abuse
strings suspicious_binary | grep -iE "(security\s+find-|security\s+dump-|security\s+export|security\s+unlock)"

# Check for direct Keychain database access
strings suspicious_binary | grep -iE "(login\.keychain|System\.keychain|\.keychain-db)"

# Check for password prompts (social engineering for Keychain unlock)
strings suspicious_binary | grep -iE "(osascript.*password|display dialog.*password|System Preferences)"
```

**Browser credential theft:**
```bash
# Check for Chrome credential access
strings suspicious_binary | grep -iE "(Login Data|Chrome.*Safe Storage|Cookies|Web Data)"

# Check for Firefox credential access
strings suspicious_binary | grep -iE "(logins\.json|key4\.db|cert9\.db|cookies\.sqlite)"

# Check for Safari credential access
strings suspicious_binary | grep -iE "(Safari.*Passwords|Keychain.*Safari)"

# Check for cookie theft patterns
strings suspicious_binary | grep -iE "(/Library/Cookies|Cookies\.binarycookies)"
```

**Crypto wallet theft:**
```bash
# Check for cryptocurrency wallet targeting
strings suspicious_binary | grep -iE "(Electrum|Exodus|Atomic|Metamask|Coinbase|wallet\.dat)"
strings suspicious_binary | grep -iE "(Bitcoin|Ethereum|\.wallet|keystore)"
```

### Step 5: macOS-Specific API Abuse

Detect abuse of macOS-unique APIs and frameworks.

**AppleScript and osascript abuse:**
```bash
# Check for osascript execution
strings suspicious_binary | grep -iE "(osascript|NSAppleScript|OSAScript|JavaScript.*automation)"

# Check for AppleScript-based prompts (credential phishing)
strings suspicious_binary | grep -iE "(display dialog|display alert|display notification)"

# Check for System Events scripting
strings suspicious_binary | grep -iE "(System Events|keystroke|key code|click|UI element)"

# Check for JavaScript for Automation (JXA)
strings suspicious_binary | grep -iE "(ObjC\.import|\.currentApplication|Application\()"
```

**TCC/PPPC bypass analysis:**
```bash
# Check for TCC database manipulation
strings suspicious_binary | grep -iE "(TCC\.db|tcc|kTCCService|accessibility|fullDiskAccess)"

# Check for TCC bypass techniques
strings suspicious_binary | grep -iE "(tccd|com\.apple\.tccd|DARWIN_TCC)"

# Direct TCC database query (for forensics)
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
  "SELECT client, service, auth_value FROM access WHERE auth_value > 0;" 2>/dev/null

# Check system TCC database
sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  "SELECT client, service, auth_value FROM access;" 2>/dev/null
```

**Transparency Consent framework indicators:**
```bash
# Check for screen capture capabilities
strings suspicious_binary | grep -iE "(CGWindowListCreateImage|SCShareableContent|kCGWindowListOption)"

# Check for camera/microphone access
strings suspicious_binary | grep -iE "(AVCaptureSession|AVAudioRecorder|AVCaptureDevice)"

# Check for accessibility API abuse
strings suspicious_binary | grep -iE "(AXIsProcessTrusted|AXUIElement|kAXTrustedCheckOptionPrompt)"
```

### Step 6: Known macOS Malware Family Identification

Identify specific malware families based on behavioral markers and signatures.

**XCSSET indicators:**
```bash
# XCSSET targets Xcode projects and uses Safari exploitation
strings suspicious_binary | grep -iE "(xcsset|\.xcodeproj|xcworkspace|safari.*inject)"
strings suspicious_binary | grep -iE "(replicator|camtrigger|screen_sim)"

# Check for Xcode project infection
find ~/Developer -name "*.xcodeproj" -exec grep -l "XCSSET\|suspicious_script" {} \; 2>/dev/null
```

**Atomic Stealer (AMOS) indicators:**
```bash
# Atomic Stealer targets credentials, wallets, and browser data
strings suspicious_binary | grep -iE "(atomicstealer|amos|/Users/.*/Library/Keychains)"
strings suspicious_binary | grep -iE "(Electrum|Exodus|Coinomi|TronLink|MetaMask)"

# Check for fake installer patterns
strings suspicious_binary | grep -iE "(crack|patch|keygen|activate|serial)"

# Check for DMG bundling
strings suspicious_binary | grep -iE "(create-dmg|hdiutil create|\.app/Contents/MacOS)"
```

**RustBucket indicators:**
```bash
# RustBucket (attributed to DPRK/Lazarus) uses staged payloads
strings suspicious_binary | grep -iE "(rustbucket|InternalPDF|PDFViewer)"

# Check for URL-based payload staging
strings suspicious_binary | grep -iE "(https?://[^\s]*\.(zip|dmg|pkg|app))"

# Check for Rust compilation artifacts
strings suspicious_binary | grep -iE "(rustc|cargo|core::panicking|std::rt)"
```

**Lazarus group macOS tools:**
```bash
# Lazarus uses social engineering with trojanized apps
strings suspicious_binary | grep -iE "(TraderTraitor|AppleJeus|CryptoTrader|DeFiApp)"

# Check for cryptocurrency platform targeting
strings suspicious_binary | grep -iE "(binance|coinbase|blockchain\.com|crypto\.com)"

# Check for custom C2 protocol indicators
strings suspicious_binary | grep -iE "(X-Request-ID|X-Auth-Token)" | head -10

# Check for encrypted config or payload
otool -l suspicious_binary | grep -A4 "__DATA.*__config"
```

**Run family identification:**
```bash
python3 scripts/macos_malware_analyzer.py \
  --sample suspicious_binary \
  --mode family-id \
  --output family_identification.json
```

### Step 7: Code Signing Analysis

Examine code signing, certificates, and entitlements for authenticity and abuse indicators.

**Code signature verification:**
```bash
# Verify code signature
codesign -dv --verbose=4 suspicious_binary 2>&1

# Display signing certificate chain
codesign -d --verbose=4 suspicious_binary 2>&1 | grep -E "(Authority|TeamIdentifier|Timestamp)"

# Check if signature is valid
codesign --verify --verbose suspicious_binary 2>&1

# Display entitlements (privileges requested)
codesign -d --entitlements - suspicious_binary 2>&1
```

**Certificate analysis:**
```bash
# Extract the signing certificate
codesign -d --extract-certificates suspicious_binary 2>/dev/null
# If extracted, examine the certificate
openssl x509 -inform DER -in codesign0 -text -noout 2>/dev/null

# Check for ad-hoc signing (no real certificate)
codesign -dv suspicious_binary 2>&1 | grep "Signature=adhoc"

# Check for expired or revoked certificates
spctl --assess --verbose=4 --type execute suspicious_binary 2>&1

# Check for stolen/known-bad Team IDs
codesign -dv suspicious_binary 2>&1 | grep "TeamIdentifier"
```

**Entitlement abuse detection:**
```bash
# Look for dangerous entitlements
codesign -d --entitlements - suspicious_binary 2>&1 | grep -iE \
  "(com\.apple\.security\.cs\.disable-library-validation|com\.apple\.private|com\.apple\.security\.cs\.allow-dyld-environment-variables|com\.apple\.security\.cs\.allow-unsigned-executable-memory|get-task-allow)"

# Check for entitlement escalation
codesign -d --entitlements - suspicious_binary 2>&1 | grep -iE \
  "(keychain-access-groups|application-identifier|com\.apple\.security\.device)"
```

### Step 8: macOS Sandbox Escape Techniques

Identify techniques used to escape the macOS App Sandbox.

**Sandbox profile analysis:**
```bash
# Check if the binary has a sandbox profile
codesign -d --entitlements - suspicious_binary 2>&1 | grep "com.apple.security.app-sandbox"

# Check for sandbox escape indicators
strings suspicious_binary | grep -iE "(sandbox_init|sandbox-exec|sandbox_extension|sandbox_check)"

# Look for IPC-based escape techniques
strings suspicious_binary | grep -iE "(NSXPCConnection|XPC|launchd|mach_msg|bootstrap_look_up)"

# Check for file system escape paths
strings suspicious_binary | grep -iE "(/private/var|/Library/Caches|group\..*containers)"
```

**Known sandbox escape patterns:**
```bash
# Check for CVE-related patterns
strings suspicious_binary | grep -iE "(CVE-20[0-9]{2}|exploit|heap_overflow|use_after_free)"

# Check for dylib injection into unsandboxed processes
strings suspicious_binary | grep -iE "(DYLD_INSERT_LIBRARIES|DYLD_FRAMEWORK_PATH|@rpath|@executable_path)"

# Check for XPC service abuse
strings suspicious_binary | grep -iE "(com\.apple\.[a-z]+d|com\.apple\.security|launchctl)"

# Check for mount point manipulation
strings suspicious_binary | grep -iE "(diskutil|hdiutil attach|mount_.*fs|bindfs)"
```

**Collect forensic artifacts:**
```bash
# Unified log analysis for sandbox violations
log show --predicate 'subsystem == "com.apple.sandbox"' --last 1h --info 2>/dev/null

# Check sandbox violation logs
log show --predicate 'eventMessage contains "deny"' --last 1h --info 2>/dev/null | head -50

# Export crash reports (sandbox crashes indicate escape attempts)
ls -la ~/Library/Logs/DiagnosticReports/ 2>/dev/null
```

**Run full analysis:**
```bash
python3 scripts/macos_malware_analyzer.py \
  --sample suspicious_binary \
  --mode full-analysis \
  --output full_analysis.json
```

## Output Format

```json
{
  "sample": {
    "filename": "suspicious_binary",
    "sha256": "a1b2c3d4e5f6...",
    "file_type": "Mach-O 64-bit executable arm64",
    "size_bytes": 2097152,
    "universal_binary": true,
    "architectures": ["x86_64", "arm64"]
  },
  "macho_analysis": {
    "architecture": "arm64",
    "sdk_version": "14.0",
    "min_os_version": "12.0",
    "load_commands": 24,
    "linked_libraries": ["/usr/lib/libSystem.B.dylib", "/usr/lib/libobjc.A.dylib"],
    "rpath_entries": [],
    "has_objc_classes": true,
    "class_names": ["AppDelegate", "PayloadManager", "C2Client"],
    "encrypted": false,
    "stripped": true,
    "compiler": "Apple clang 15.0"
  },
  "code_signing": {
    "signed": true,
    "signature_valid": false,
    "ad_hoc": false,
    "authority": ["Developer ID Application: Fake Company (XXXXXXXXXX)"],
    "team_identifier": "XXXXXXXXXX",
    "timestamp": "2024-06-15T10:30:00Z",
    "certificate_expired": true,
    "notarized": false,
    "entitlements": [
      "com.apple.security.cs.allow-dyld-environment-variables",
      "com.apple.security.cs.disable-library-validation"
    ],
    "suspicious_entitlements": [
      "com.apple.security.cs.allow-dyld-environment-variables"
    ]
  },
  "family_identification": {
    "family": "Atomic Stealer",
    "confidence": "high",
    "variant": "AMOS v2.1",
    "indicators": [
      "Keychain database access pattern",
      "Browser credential harvesting (Chrome, Firefox, Safari)",
      "Cryptocurrency wallet targeting (Exodus, MetaMask)"
    ]
  },
  "persistence": {
    "launch_agents": {
      "found": true,
      "items": [{
        "path": "~/Library/LaunchAgents/com.helper.update.plist",
        "program": "/Users/victim/.helper/updater",
        "run_at_load": true,
        "keep_alive": true
      }]
    },
    "launch_daemons": {
      "found": false,
      "items": []
    },
    "login_items": {
      "found": false,
      "items": []
    },
    "kernel_extensions": {
      "found": false,
      "items": []
    },
    "cron": {
      "found": false,
      "entries": []
    }
  },
  "credential_theft": {
    "keychain_access": true,
    "browser_credentials": ["Chrome", "Firefox", "Safari"],
    "crypto_wallets": ["Exodus", "MetaMask", "Coinbase Wallet"],
    "ssh_keys": false,
    "cookies": true
  },
  "gatekeeper_bypass": {
    "quarantine_stripped": true,
    "bypass_technique": "Quarantine attribute removed via xattr -d",
    "notarization_status": "not notarized"
  },
  "sandbox_escape": {
    "attempts_detected": false,
    "techniques": []
  },
  "iocs": {
    "sha256": ["a1b2c3d4e5f6..."],
    "ip_addresses": ["198.51.x.x"],
    "domains": ["update.example.com"],
    "file_paths": ["~/Library/LaunchAgents/com.helper.update.plist", "/Users/victim/.helper/updater"],
    "team_identifiers": ["XXXXXXXXXX"]
  },
  "mitre_attack": ["T1059.002", "T1547.011", "T1555.001", "T1539", "T1553.001", "T1056.002"]
}
```

## Tips

- Always analyze macOS malware on an isolated macOS VM; use IPSW or macOS Sonoma VMs in Apple Virtualization Framework or UTM
- Universal (fat) binaries can contain different payloads per architecture; always analyze both x86_64 and arm64 slices separately
- Many macOS malware families are distributed as DMG files; mount and inspect without executing by using `hdiutil attach -nomount`
- Objective-C class names from `class-dump` often reveal malware capabilities directly (e.g., `KeychainStealer`, `C2Manager`)
- LaunchAgents with `RunAtLoad: true` and `KeepAlive: true` are a strong persistence indicator
- Legitimate Apple binaries are always signed by Apple; any modification invalidates the signature
- The TCC database (`TCC.db`) records which apps have been granted sensitive permissions; check for unauthorized grants
- macOS malware increasingly uses Swift and Rust, making static analysis harder; focus on dynamic analysis and API monitoring
- Use Objective-See's free tools (KnockKnock for persistence, LuLu for firewall, BlockBlock for monitoring) for rapid triage
- Check the unified log (`log show`) for sandbox violations, TCC prompts, and Gatekeeper decisions
- Ad-hoc signed binaries (no developer certificate) should be treated with high suspicion
- macOS 15+ uses Background Task Management that persists across reboots; check `sfltool dumpbtm` for registered items
- For disk images (DMG), check for hidden files and symlinks that exploit Finder's display behavior