1. Home
  2. Software
  3. macOS.OSAMiner

macOS.OSAMiner

macOS.OSAMiner is a Monero mining trojan that was first observed in 2018; security researchers assessed macOS.OSAMiner may have been circulating since at least 2015. macOS.OSAMiner is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.[1][2]

ID: S1048
ⓘ
Type: MALWARE
ⓘ
Platforms: macOS
Version: 1.0
Created: 04 October 2022
Last Modified: 19 October 2022
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1059 .002 Command and Scripting Interpreter: AppleScript

macOS.OSAMiner has used osascript to call itself via the do shell script command in the Launch Agent .plist file.[1]
Enterprise T1543 .001 Create or Modify System Process: Launch Agent

macOS.OSAMiner has placed a Stripped Payloads with a plist extension in the Launch Agent's folder. [1]
Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's install.log for apps matching its hardcoded list, killing all matching process names.[1]
Enterprise T1105 Ingress Tool Transfer

macOS.OSAMiner has used curl to download a Stripped Payloads from a public facing adversary-controlled webpage.

Enterprise T1027 .008 Obfuscated Files or Information: Stripped Payloads

macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.[1]
.009 Obfuscated Files or Information: Embedded Payloads

macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.[1]
Enterprise T1057 Process Discovery

macOS.OSAMiner has used ps ax | grep <name> | grep -v grep | ... and ps ax | grep -E... to conduct process discovery.[1]
Enterprise T1082 System Information Discovery

macOS.OSAMiner can gather the device serial number and has checked to ensure there is enough disk space using the Unix utility df.[1]
Enterprise T1569 .001 System Services: Launchctl

macOS.OSAMiner has used launchctl to restart the Launch Agent.[1]
Enterprise T1497 .001 Virtualization/Sandbox Evasion: System Checks

macOS.OSAMiner can parse the output of the native system_profiler tool to determine if the machine is running with 4 cores.[1]

References

  1. Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.
  1. VMRAY. (2021, January 14). Malware Analysis Spotlight: OSAMiner Uses Run-Only AppleScripts to Evade Detection. Retrieved October 4, 2022.