This video is a code walkthrough of the "Banshee" information-stealing malware for macOS, written in Objective-C. The analysis covers the malware's complete execution flow, from its initial launch where it detaches from the terminal, to its data exfiltration and cleanup phases. Key functionalities examined include its primitive anti-debugging and anti-VM checks, a social engineering prompt to steal the user's password, and its methods for collecting data from browsers (Chrome, Firefox, etc.), crypto wallets, Safari, and the system keychain. A significant portion of the analysis focuses on the malware's reliance on writing all stolen data to a temporary directory on disk before compressing, encrypting, and sending it to a C2 server. The presenter concludes with a critique of the malware's implementation, noting its poor operational security, lack of obfuscation, and easily bypassed evasion techniques, which create a large forensic footprint.
Anatomy of the Banshee macOS Stealer
00:05:10 Entry Point & Relaunch: The malware's main function immediately relaunches itself with the arguments "run controller" and a hardcoded key. This is a simple technique to detach the main payload from the user's terminal session.
00:12:43 Anti-Analysis Checks: It performs two basic checks: one for a debugger using a P_TRACED flag via a syscall, and another for a virtual machine by running system_profiler and checking if the model identifier contains the string "virtual". As far as I can tell, these are trivial to bypass.
00:18:47 Password Theft via Social Engineering: The malware uses an osascript command to display a fake "System Preferences" update dialog, tricking the user into entering their macOS password. It then attempts to validate this password using the dscl command-line utility.
00:23:11 Browser & Crypto Wallet Data Collection: It targets non-Safari browsers (Chrome, Firefox, Brave, etc.) by locating their profile directories and copying sensitive files like cookies, login data, and history. It also specifically looks for crypto wallet browser extensions and copies their data. All stolen files are staged in a temporary directory.
00:31:31 System Information Gathering: It gathers detailed hardware and software information using system_profiler, fetches the public IP address, and combines this with the stolen password into a system_info.json file, which is also written to the temporary directory.
00:41:44 Safari & File Grabbing: A separate, lengthy AppleScript is used to exfiltrate Safari data, user notes, and files with specific extensions (.txt, .docx, .wallet) from the user's Desktop and Documents folders.
00:50:24 Keychain Dumping: The malware locates the user's keychain database files and copies them directly to its temporary staging folder.
00:57:04 Data Exfiltration: All collected data in the temporary folder is compressed into a zip archive. This archive is then read into memory, XOR-encrypted with a randomly generated 15-character key, Base64 encoded, and finally sent to a hardcoded C2 server via an HTTP POST request.
01:04:02 Cleanup: After the data is sent, the malware attempts to remove the temporary directory and any scripts it wrote to disk.
01:11:17 Final Critique: The presenter concludes the malware is unsophisticated. Its primary weakness is writing all stolen data to disk, which leaves a massive forensic footprint for any endpoint security product to detect. Other noted failures include a complete lack of string obfuscation and simplistic evasion checks.