FAUTLReports

The Mac Malware of 2024

2025-01-01

Author: Patrick Wardle

malware_types:ransomware file_types:rar architecture:arm malware_types:loader architecture:x86_64 file_types:python file_types:javascript file_types:mach-o techniques:malware analysis tools file_types:rtf

Apple Gets an 'F' for Slicing Apples

2024-02-22

Objective-See

Author: Patrick Wardle

architecture:arm malware_types:loader architecture:x86_64 file_types:so file_types:macho file_types:cpp platforms:macos file_types:mach-o debugger:lldb file_types:dylib

It's Turtles All The Way Down

2023-11-30

Objective-See

Author: Patrick Wardle

malware_types:ransomware file_types:zip platforms:linux file_types:txt architecture:arm architecture:x86_64 file_types:so malware_types:trojan architecture:arm64 file_types:mach-o

The LockBit ransomware (kinda) comes for macOS

2023-04-16

Objective-See

Author: Patrick Wardle

malware_types:ransomware file_types:dll file_types:zip platforms:linux file_types:txt file_types:dat architecture:arm file_types:python file_types:json file_types:mach-o

Ironing out (the macOS) details of a Smooth Operator (Part I)

2023-03-29

Objective-See

Author: Patrick Wardle

file_types:dll architecture:arm malware_types:loader architecture:x86_64 file_types:so architecture:x64 platforms:macos file_types:mach-o debugger:lldb techniques:anti-analysis

Analyzing OSX.DazzleSpy

2022-01-25

Objective-See

Author: Patrick Wardle

architecture:arm architecture:x86_64 techniques:persistence file_types:xml platforms:macos file_types:mach-o cve:cve-2019-8526 file_types:objective-c file_types:pptx file_types:docx

The Mac Malware of 2021

2022-01-01

Objective-See

Author: Patrick Wardle

file_types:zip platforms:linux architecture:arm architecture:x86_64 file_types:python file_types:javascript file_types:mach-o techniques:malware analysis tools malware_types:password stealer cve:cve-2021-1789

OSX.Hydromac

2021-06-04

Objective-See

Author: Taha Karim

architecture:arm malware_types:loader file_types:python techniques:honeypot file_types:so malware_types:downloader techniques:persistence disassembler:ida pro platforms:macos malware_types:adware

MMD-0067-2021 - Recent talks on Linux process injection and shellcode analysis series (ROOTCON-2020, R2CON-2020 ++)

2021-03-03

MalwareMustDie

Author: unixfreaxjp

platforms:linux malware_types:fileless architecture:arm debugger:gdb malware_types:loader architecture:mips file_types:html disassembler:objdump disassembler:die techniques:code injection

ROOTCON 2020 - Deeper diving into shellcode (advanced users)

2021-03-03

MalwareMustDie

Author: unixfreaxjp

platforms:linux malware_types:fileless architecture:arm debugger:gdb malware_types:loader architecture:mips file_types:html disassembler:objdump disassembler:die techniques:code injection

R2CON 2020 - So you don't like shellcode too? (for r2 RE beginners)

2021-03-03

MalwareMustDie

Author: unixfreaxjp

platforms:linux malware_types:fileless architecture:arm debugger:gdb malware_types:loader architecture:mips file_types:html disassembler:objdump disassembler:die techniques:code injection

Arm'd & Dangerous

2021-02-14

Objective-See

Author: Patrick Wardle

file_types:bin architecture:arm architecture:x86_64 file_types:sh file_types:so file_types:go malware_types:trojan platforms:macos architecture:arm64 file_types:mach-o

The Mac Malware of 2020

2021-01-01

Objective-See

Author: Patrick Wardle

malware_types:ransomware platforms:linux file_types:dat architecture:arm architecture:x86_64 file_types:python file_types:javascript file_types:mach-o techniques:malware analysis tools techniques:kernel-mode rootkit

MMD-0066-2020 - Linux/Mirai-Fbot - A re-emerged IoT threat

2020-02-24

MalwareMustDie

Author: unixfreaxjp

platforms:linux architecture:x86 file_types:pdf file_types:bin architecture:arm malware_types:loader architecture:x86_64 file_types:python techniques:unpacking techniques:honeypot

MMD-0065-2020 - Linux/Mirai-Fbot's new encryption explained

2020-01-15

MalwareMustDie

Author: unixfreaxjp

platforms:linux techniques:system calls architecture:arm architecture:mips disassembler:die architecture:x86_64 file_types:sh file_types:elf malware_types:botnet file_types:so

MMD-0064-2019 - Linux/AirDropBot

2019-09-28

MalwareMustDie

Author: unixfreaxjp

platforms:linux architecture:x86 file_types:pdf architecture:arm architecture:x86_64 techniques:unpacking file_types:sh malware_types:botnet file_types:so malware_types:worm

MMD-0063-2019 - Summary of three years research (Sept 2016-Sept 2019)

2019-09-21

MalwareMustDie

Author: unixfreaxjp

file_types:ruby platforms:linux file_types:powershell architecture:arm techniques:unpacking file_types:elf file_types:so file_types:macho malware_types:rootkit file_types:go

MMD-0059-2016 - Linux/IRCTelnet (new Aidra)

2016-10-29

MalwareMustDie

Author: unixfreaxjp

platforms:linux architecture:arm malware_types:loader architecture:mips file_types:sh file_types:elf malware_types:rootkit malware_types:virus malware_types:backdoor techniques:persistence

MMD-0058-2016 - Linux/NyaDrop - MIPS IoT bad news

2016-10-14

MalwareMustDie

Author: unixfreaxjp

platforms:linux file_types:pe architecture:arm malware_types:loader architecture:mips techniques:honeypot file_types:elf malware_types:botnet malware_types:virus malware_types:backdoor

MMD-0057-2016 - Linux/LuaBot - IoT botnet as service

2016-09-06

MalwareMustDie

Author: unixfreaxjp

platforms:linux architecture:arm file_types:sh file_types:elf malware_types:botnet malware_types:backdoor file_types:javascript file_types:js malware_types:trojan techniques:encryption

Malware Analysis Reports