Mac-A-Mal: macOS malware analysis framework resistant to anti evasion techniques

D.-P. Pham; D.-L. Vu; Fabio Massacci

doi:10.1007/s11416-019-00335-w

Mac-A-Mal: macOS malware analysis framework resistant to anti evasion techniques

D.-P. Pham
, D.-L. Vu
, Fabio Massacci

Research output: Contribution to Journal › Article › Academic › peer-review

Abstract

With macOS increasing popularity, the number, and variety of macOS malware are rising as well. Yet, very few tools exist for dynamic analysis of macOS malware. In this paper, we propose a macOS malware analysis framework called Mac-A-Mal. We develop a kernel extension to monitor malware behavior and mitigate several anti-evasion techniques used in the wild. Our framework exploits the macOS features of XPC service invocation that typically escape traditional mechanisms for detection of children processes. Performance benchmarks show that our system is comparable with professional tools and able to withstand VM detection. By using Mac-A-Mal, we discovered 71 unknown adware samples (8 of them using valid distribution certificates), 2 keyloggers, and 1 previously unseen trojan involved in the APT32 OceanLotus.

Original language	English
Pages (from-to)	249-257
Number of pages	9
Journal	Journal of Computer Virology and Hacking Techniques
Volume	15
Issue number	4
Early online date	19 Jun 2019
DOIs	https://doi.org/10.1007/s11416-019-00335-w
Publication status	Published - Dec 2019

Funding

The project leading to this paper has received funding from the European Union’s Horizon 2020 research and innovation programme under Grant Agreement No 675320 (NeCS: European Network for Cyber Security). This work was also partially supported by Securify B.V.

Funders	Funder number
Securify B.V.
Horizon 2020 Framework Programme	675320

Access to Document

10.1007/s11416-019-00335-w

Persistent URL (handle)

Persistent link

Cite this

@article{e14f1e76a90f4918b94a17e1d2e96f92,

title = "Mac-A-Mal: macOS malware analysis framework resistant to anti evasion techniques",

abstract = "With macOS increasing popularity, the number, and variety of macOS malware are rising as well. Yet, very few tools exist for dynamic analysis of macOS malware. In this paper, we propose a macOS malware analysis framework called Mac-A-Mal. We develop a kernel extension to monitor malware behavior and mitigate several anti-evasion techniques used in the wild. Our framework exploits the macOS features of XPC service invocation that typically escape traditional mechanisms for detection of children processes. Performance benchmarks show that our system is comparable with professional tools and able to withstand VM detection. By using Mac-A-Mal, we discovered 71 unknown adware samples (8 of them using valid distribution certificates), 2 keyloggers, and 1 previously unseen trojan involved in the APT32 OceanLotus.",

author = "D.-P. Pham and D.-L. Vu and Fabio Massacci",

year = "2019",

month = dec,

doi = "10.1007/s11416-019-00335-w",

language = "English",

volume = "15",

pages = "249--257",

journal = "Journal of Computer Virology and Hacking Techniques",

issn = "2263-8733",

publisher = "Springer Science + Business Media",

number = "4",

}

TY - JOUR

T1 - Mac-A-Mal: macOS malware analysis framework resistant to anti evasion techniques

AU - Pham, D.-P.

AU - Vu, D.-L.

AU - Massacci, Fabio

PY - 2019/12

Y1 - 2019/12

N2 - With macOS increasing popularity, the number, and variety of macOS malware are rising as well. Yet, very few tools exist for dynamic analysis of macOS malware. In this paper, we propose a macOS malware analysis framework called Mac-A-Mal. We develop a kernel extension to monitor malware behavior and mitigate several anti-evasion techniques used in the wild. Our framework exploits the macOS features of XPC service invocation that typically escape traditional mechanisms for detection of children processes. Performance benchmarks show that our system is comparable with professional tools and able to withstand VM detection. By using Mac-A-Mal, we discovered 71 unknown adware samples (8 of them using valid distribution certificates), 2 keyloggers, and 1 previously unseen trojan involved in the APT32 OceanLotus.

AB - With macOS increasing popularity, the number, and variety of macOS malware are rising as well. Yet, very few tools exist for dynamic analysis of macOS malware. In this paper, we propose a macOS malware analysis framework called Mac-A-Mal. We develop a kernel extension to monitor malware behavior and mitigate several anti-evasion techniques used in the wild. Our framework exploits the macOS features of XPC service invocation that typically escape traditional mechanisms for detection of children processes. Performance benchmarks show that our system is comparable with professional tools and able to withstand VM detection. By using Mac-A-Mal, we discovered 71 unknown adware samples (8 of them using valid distribution certificates), 2 keyloggers, and 1 previously unseen trojan involved in the APT32 OceanLotus.

U2 - 10.1007/s11416-019-00335-w

DO - 10.1007/s11416-019-00335-w

M3 - Article

SN - 2263-8733

VL - 15

SP - 249

EP - 257

JO - Journal of Computer Virology and Hacking Techniques

JF - Journal of Computer Virology and Hacking Techniques

IS - 4

ER -

Mac-A-Mal: macOS malware analysis framework resistant to anti evasion techniques

Abstract

Funding

Access to Document

Persistent URL (handle)

Fingerprint

Cite this