![]() And for deeper analysis, the second and third stages are visible and available from the VMRay Analyzer Report. Within 2 minutes of analysis time, analysts can see a majority of the sample’s behavior, compared to hours of manual reverse engineering. Running the sample in VMRay gives analysts an immediate view into the key behaviors, characteristics, and IOCs. This file type won’t have a problem running on a victim’s machine but it is difficult for security teams to analyze because of the inherent obfuscation and limited tooling available. In addition, the second stage uses the system tool “caffeinate” to prevent the machine from going to sleep while the first stage will continuously query the running processes for common AV programs using the ps command: sh -c ps ax | grep -E '360|Keeper|MacMgr|Lemon|Malware|Avast|Avira|CleanMyMac' | grep -v grep | awk ''Īll of these actions are performed using sub-processes so they can be observed in the process graph and process overview.Īs we can see, this sample uses a different kind of evasion, using a rather uncommon file type, a compiled AppleScript, disguised as a PLIST file. The third stage is a zip file containing two dynamic libraries (dylibs) and finally a Mach-O binary, again disguised as a PLIST which can be clearly seen in the Files Tab. ![]()
0 Comments
Leave a Reply. |