Abstract:

This analysis explores the publicly leaked source code of the Mac Banshee Stealer, written in Objective C. The malware employs rudimentary stealth, relying on process relaunching and minimal anti-VM/anti-debug checks. Its primary method involves harvesting sensitive data—including passwords obtained via a deceptive system prompt, browser databases (cookies, credentials), crypto wallet extensions, system info, and user files—and staging all collected information in a temporary directory on disk. The staged data is then compressed, XOR encrypted with an internal key, and exfiltrated via a JSON POST request to a hardcoded Command and Control (C2) address. The implementation is notably poor regarding operational security (OpSec), exhibiting significant forensic artifacts due to extensive disk I/O for data staging.

Exploring the Mac Banshee Stealer (Objective C Source Code)

• 0:03 Introduction: Examination of the Objective C source code for the Banshee Stealer, available from the VX Underground malware repository.
• 9:02 Initial Execution/Stealth: The malware relaunches itself using NSTask with the argument run controller and the hardcoded encryption key, then immediately kills the originating terminal process for rudimentary stealth.
• 11:06 Anti-Analysis Checks: Performs highly basic checks: 1) Determines if a debugger is attached (checking P_TRACED). 2) Checks if running in a VM by examining the system profiler output for the substring "virtual." These checks are, frankly, easily bypassed.
• 16:47 OpSec Failure: Data Staging: Initializes a temporary directory under /tmp/ appended with 25 random characters for staging all collected data. Storing massive amounts of stolen information to disk before exfiltration is extremely poor operational security.
• 18:40 Password Harvesting: Uses osascript to display a system-like dialogue box, deceiving the user into entering their macOS password ("update system settings"). The password attempt is validated locally using the dscl command-line utility.
• 23:07 Browser Data Collection (Excluding Safari): Collects data (cookies, history, login data/passwords, autofills, crypto wallet extension data) from numerous Chromium and Firefox derivatives (Chrome, Brave, Edge, Vivaldi, etc.). All data is copied directly to the temporary directory structure on disk.
• 31:28 System Info Collection: Gathers system software and hardware data (system profiler) and public IP address (via external services). This information, including the stolen password, is written to disk as a system_info.json file. The fact that the stolen password is written to disk in a pretty-printed JSON file is evidence of lazy engineering.
• 41:17 File Grab and Keychain: Executes a complex osascript routine to bypass permissions (attempting to reset the TCC database if needed) to copy Safari data, Notes SQLite databases, the macOS Keychain database, and specific files (.txt, .wallet, .keys) from the Desktop and Documents folders.
• 57:04 Data Compression and Exfiltration: The entire staged folder is compressed into a zip file using ditto. The zip data is then read into memory, XOR encrypted using the session key, Base64 encoded, and sent as a JSON POST request to the hardcoded C2 server address (remote IP).
• 1:03:55 Cleanup: Recursively removes the temporary folder and the generated Apple script files after successful data exfiltration.
• 1:11:17 Critical Takeaway: The malware suffers from a significant lack of evasion (e.g., using plaintext strings for C2 addresses and commands) and poor OpSec practices, particularly the heavy reliance on disk I/O for staging stolen data, which leaves a clear forensic footprint.