Abstract:

This analysis dissects the leaked Objective C source code of the Mac Banshee Stealer malware. The malware first attempts trivially defeated anti-VM and anti-debugging checks. Its primary data collection workflow involves a social engineering attempt via an Osa Script dialogue to phish the user's macOS password, which it validates using dscl. Data collection focuses on browser artifacts (credentials, history, cookies), specified crypto wallet directories, and the keychain database. Critically, as far as I can tell, the gathered sensitive data is inefficiently staged directly on disk in a randomly named temporary directory before being compressed, weakly XOR-encrypted, Base64 encoded, and exfiltrated to a C2 server. The reliance on easily scanned strings and extensive disk I/O makes this implementation poorly evasive and detectable by standard endpoint security products.

Analysis of the Mac Banshee Stealer (Objective C)

• 0:51 Source Access & Language: The analyzed source code was allegedly leaked from the VX Underground malware repository. I don't care about the Objective C crash course (1:09), but the syntax uses [Object Method:parameter] calls.
• 9:07 Initial Execution: The executable relaunches itself immediately as a background subprocess using an NSTask, passing the encryption key (@RT) as an argument, and then kills the terminal to avoid detection.
• 12:43 Anti-Analysis: The malware includes weak anti-analysis checks: detecting debuggers via the P_TRACED flag and identifying Virtual Machines by searching the system profiler hardware data output for the string "virtual" (14:53). These checks are easily bypassed.
• 16:50 Data Staging: A globally referenced temporary folder is initialized in /tmp/ with 25 random characters appended. All subsequent collected data is inefficiently written to this folder.
• 18:47 Credential Phishing: It attempts to obtain the user's macOS password using a deceptive pop-up dialogue generated by an Osa Script (19:27), mimicking a system settings update prompt. It verifies the recovered password using the dscl command-line utility (20:38).
• 23:11 Browser Data Collection: The stealer targets multiple browsers (Chrome, Firefox, Brave, etc.), excluding Safari initially. It retrieves essential files (web data, history, cookies, login data) and copies them to the temporary staging folder (28:50). This reliance on disk I/O is terrible and lazy.
• 31:31 System Information: Collects software and hardware details via system profiler and public IP information via external endpoints (38:10). This information, along with the phished macOS password, is compiled into a JSON structure (system_info.json) and also written to the temporary staging folder (37:15).
• 41:43 File/Data Grab (Safari & Misc): A complex Apple Script is executed to gather additional data, primarily targeting Safari cookies, Notes SQLite databases, and user files (from Desktop/Documents) matching specific extensions (.wallet, .keys, .txt, .rtf). Execution attempts to bypass or trigger TCC/permission prompts (47:35).
• 50:24 Keychain & Wallet Data: The keychain database is copied, and specific crypto wallet data (e.g., Exodus, 55:39) is copied from their respective Application Support directories to the staging folder.
• 57:04 Exfiltration Preparation: All staged data in the temporary folder is archived into a single .zip file using the ditto command (57:10).
• 58:08 C2 Communication: The zipped data is read into memory, XOR-encrypted using the weak key passed during initialization (1:02:40), Base64 encoded, bundled into a JSON payload, and asynchronously posted to the C2 server using NSURLSession.
• 1:04:02 Cleanup: The temporary staging folder and all generated intermediate files (including the Apple Script used for file grabbing) are recursively deleted.
• 1:11:23 Critical Takeaway: The design is poor. The lack of string obfuscation, the use of easily intercepted system calls (system profiler, dscl), and especially the massive forensic footprint created by copying all stolen data to disk prior to exfiltration (1:13:20) indicate a highly inefficient and easily detectable piece of malware.