This video provides an in-depth analysis of the leaked Objective-C source code for the "Banshee" macOS information stealer. The walkthrough covers its execution flow, anti-debugging and anti-VM checks, and its multi-faceted data theft capabilities. Key functions include tricking users for their system password via a fake prompt, exfiltrating data from numerous web browsers (including crypto-wallet extensions), stealing the macOS Keychain, and grabbing files from user directories. The malware stages all collected information in a temporary folder on disk before compressing, XOR-encrypting, and exfiltrating it to a C2 server. The analysis concludes with a critique of the malware's simplistic design, highlighting its poor operational security, such as leaving a significant forensic footprint on disk and using easily detectable, un-obfuscated strings.
Dissecting the Banshee macOS Stealer: A Code Walkthrough
0:00 Introduction: The video introduces a walkthrough of the leaked source code for the Banshee Stealer, a piece of macOS malware written in Objective-C.
5:10 Execution Flow: The malware's entry point shows that it relaunches itself with specific command-line arguments to run its main payload, effectively detaching from the user's terminal.
12:43 Anti-Analysis Checks: Before executing its core logic, the malware performs basic checks to see if it is running in a virtual machine (by parsing system_profiler output for "virtual") or being debugged (by checking the P_TRACED flag).
16:47 Data Staging: A temporary directory is created under /tmp/ with a 25-character random name. This folder is used to stage all stolen data before it is sent to the command-and-control (C2) server. As far as I can tell, this is terrible forensic hygiene.
18:47 macOS Password Theft: The malware uses an AppleScript to display a fake "System Preferences" dialog box, asking the user to enter their password to "update system settings." It then validates the password using the dscl utility.
23:11 Browser Data Collection: It steals data from a wide range of browsers (Chrome, Firefox, Brave, Opera, etc.) by copying entire profile folders containing cookies, history, login data, and autofill information to its staging directory. It also specifically targets cryptocurrency wallet browser extensions.
31:28 System & IP Information: It gathers detailed hardware and software information using system_profiler, fetches the public IP address from online services, and saves this data, along with the stolen user password, into a system_info.json file in the staging directory.
41:44 Broad File & Safari Theft: A large, embedded AppleScript is executed to steal Safari browser data, system notes, and files from the user's Desktop and Documents folders that match extensions like .txt, .doc, .wallet, and .key.
50:24 Keychain Theft: The malware locates the macOS Keychain database files and copies them to the staging directory.
55:36 Standalone Wallet Theft: It searches for and copies data from various standalone cryptocurrency wallet applications, such as Exodus and Atomic.
57:04 Exfiltration Preparation: All stolen data in the temporary staging folder is compressed into a single ZIP archive. This archive is then read into memory, XOR-encrypted with a random 15-byte key, and Base64 encoded.
58:08 Data Exfiltration & Cleanup: The final encoded data is sent to a hardcoded C2 server via an HTTP POST request. After the transfer is complete, the malware deletes the temporary staging folder and all associated files from the disk.
1:11:17 Final Critique: The malware is criticized for its lack of sophistication. Its primary weaknesses are its reliance on un-obfuscated strings, easily bypassable anti-analysis checks, and its method of copying all stolen data to disk, which leaves a significant forensic footprint for security products to detect.