DEF CON 33 - Reversing approaches to extract embedded scripts in macOS malware - Patrick Wardle

[BLUF: The main goal is to identify and extract malicious scripts hidden within Mac OS binaries—commonly created using tools like Platypus, PI Installer, Electron, Tori, and Apple Script—by avoiding time-consuming reverse engineering and instead analyzing human-readable scripts that contain the actual malware logic.]2:00

Key Takeaways:
• Script-based binaries are often created using tools like Platypus or PI Installer to hide malicious scripts; identify them via hardcoded script names or embedded strings in the resource directory 8:22.
• For PI Installer, extract the Python script using a dedicated tool and decompile the bytecode to recover readable source code 10:33.
• Electron apps can be identified by Electron framework dependencies; use npx asar to extract embedded JavaScript, which is easier to analyze than compiled binaries 12:24.
• Tori apps embed scripts in the main binary using a custom compression algorithm; use a Python decompiler to extract and analyze JavaScript payloads 15:09.
• Apple Script binaries have a .scpt file in the resource directory; use specialized decompilers to reconstruct readable Apple Script code 17:59.

[Conclusion: Malware analysts should avoid reverse engineering the binary components of script-based apps and instead focus on extracting and analyzing the embedded scripts—simple, human-readable, and containing the real malicious logic—making analysis faster and more effective.]

Sources:

• 2:00 Overview of script-based binaries and the goal of efficient analysis.
• 8:22 Iden