FAUTLReports

TCCing is Believing! Apple finally adds TCC events to Endpoint Security!

2025-03-27

Objective-See

Author: Patrick Wardle

file_types:so file_types:c platforms:macos file_types:objective-c

Leaking Passwords (and more!) on macOS

2025-03-20

Objective-See

Author: Noah Gregory

malware_types:ransomware techniques:system calls file_types:so file_types:macho malware_types:backdoor techniques:privilege escalation platforms:macos platforms:ios cve:cve-2024-5447 cve:cve-2024-54471

Restoring Reflective Code Loading on macOS

2024-12-16

Objective-See

Author: Patrick Wardle

malware_types:fileless malware_types:loader file_types:so file_types:go techniques:encryption platforms:windows file_types:cpp platforms:macos file_types:mach-o file_types:dylib

The Hidden Treasures of Crash Reports

2024-08-13

Objective-See

Author: Patrick Wardle

malware_types:ransomware file_types:so file_types:c platforms:windows platforms:macos platforms:ios architecture:arm64

StormBamboo Compromises ISP to Abuse Insecure Software Update Mechanisms

2024-08-02

VOLEXITY

Author: Ankur Saini, Paul Rascagneres, Steven Adair, Thomas Lancaster

platforms:windows platforms:macos

This Meeting Should Have Been an Email

2024-07-15

Objective-See

Author: Patrick Wardle

file_types:zip file_types:exe file_types:html architecture:x86_64 file_types:python malware_types:downloader malware_types:backdoor file_types:javascript platforms:macos file_types:mach-o

Apple Gets an 'F' for Slicing Apples

2024-02-22

Objective-See

Author: Patrick Wardle

architecture:arm malware_types:loader architecture:x86_64 file_types:so file_types:macho file_types:cpp platforms:macos file_types:mach-o debugger:lldb file_types:dylib

Why Join The Navy If You Can Be A Pirate?

2024-01-15

Objective-See

Author: Patrick Wardle

file_types:zip file_types:bin architecture:x86_64 malware_types:downloader malware_types:virus techniques:persistence malware_types:trojan file_types:xml platforms:macos file_types:mach-o

Analyzing DPRK's SpectralBlur

2024-01-04

Objective-See

Author: Patrick Wardle

file_types:zip file_types:bin architecture:x86_64 file_types:sh file_types:so malware_types:backdoor techniques:encryption platforms:macos file_types:mach-o debugger:lldb

Ironing out (the macOS) details of a Smooth Operator (Part II)

2023-04-01

Objective-See

Author: Patrick Wardle

architecture:x86_64 file_types:so architecture:x64 file_types:xml file_types:json platforms:macos file_types:mach-o debugger:lldb file_types:dylib techniques:anti-analysis

Ironing out (the macOS) details of a Smooth Operator (Part I)

2023-03-29

Objective-See

Author: Patrick Wardle

file_types:dll architecture:arm malware_types:loader architecture:x86_64 file_types:so architecture:x64 platforms:macos file_types:mach-o debugger:lldb techniques:anti-analysis

Where there is love, there is ...malware?

2023-02-14

Objective-See

Author: Patrick Wardle

architecture:x86_64 file_types:so file_types:php malware_types:backdoor techniques:persistence file_types:xml platforms:macos file_types:mach-o debugger:lldb disassembler:hopper

How Shlayer Hides its Configuration

2022-12-27

Objective-See

Author: Taha Karim

file_types:html file_types:python file_types:macho malware_types:downloader file_types:bash malware_types:trojan file_types:xml platforms:macos file_types:mach-o malware_types:adware

SeaFlower 藏海花

2022-06-13

Objective-See

Author: Taha Karim

file_types:html file_types:so malware_types:backdoor file_types:javascript techniques:hooking platforms:macos platforms:ios file_types:mach-o debugger:lldb file_types:objective-c

Storm Cloud on the Horizon: GIMMICK Malware Strikes at macOS

2022-03-22

VOLEXITY

Author: Damien Cash, Steven Adair, Thomas Lancaster

platforms:windows platforms:macos

Analyzing OSX.DazzleSpy

2022-01-25

Objective-See

Author: Patrick Wardle

architecture:arm architecture:x86_64 techniques:persistence file_types:xml platforms:macos file_types:mach-o cve:cve-2019-8526 file_types:objective-c file_types:pptx file_types:docx

Where's the Interpreter!?

2021-12-22

Objective-See

Author: Patrick Wardle

file_types:bin file_types:html file_types:sh file_types:bash malware_types:virus file_types:xml platforms:macos file_types:mach-o malware_types:adware cve:cve-2021-30853

Analyzing OSX.CDDS (MacMa)

2021-11-11

Objective-See

Author: Patrick Wardle

file_types:bin architecture:x86_64 file_types:sh file_types:bash malware_types:virus malware_types:backdoor techniques:privilege escalation malware_types:keylogger malware_types:zero-day platforms:macos

Made In America: Green Lambert for OS X

2021-10-01

Objective-See

Author: Runa Sandvik

file_types:txt file_types:bin file_types:html file_types:sh file_types:php file_types:bash techniques:persistence file_types:xml platforms:macos file_types:mach-o

Analysis of CVE-2021-30860

2021-09-16

Objective-See

Author: Tom McGuire

architecture:x86_64 file_types:so techniques:sandbox platforms:macos platforms:ios file_types:mach-o disassembler:hopper cve:cve-2015-6778 cve:cve-2020-1910 cve:cve-2009-1858

Malware Analysis Reports