Dynamic Analysis of MacOS Malware Using SpriteTree
summary
SpriteTree parses ES logger captures (macOS Ventura+) into a readable process graph, rebuilding fork/exec lineage with the Responsible PID and a TrueTree layout so parentage and permission context are clear. It shows forks (smoke nodes), offers a timeline slider, and exposes command arguments and file creates. Examples: Shlayer uses openssl to decrypt payloads, nohup/killall tricks and curl downloads; meethub.gg prompts for admin via AppleScript and writes keychain exfiltration files like passwords.txt. Native Swift app; free at themittenmac.com/tools.
AI-written summary · about
chapters (12)
- 0:00Welcome
- 1:48macOS process trees challenges
- 5:49macOS process creation
- 7:59launchd limitations
- 12:17TrueTree introduction
- 18:12SpriteTree purpose
- 20:41SpriteTree data capture
- 24:37SpriteTree interface
- 29:15SpriteTree features
- 32:28Shlayer malware analysis
- 41:26meethub.gg malware analysis
- 47:32Using SpriteTree next steps
related talks
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
32mA Case Study of MacOS Supply Chain Compromise
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
41mMacOS Behavioral Detections using Apple Endpoint Security API
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
18mMac-A-Mal: An Automated Platform for Mac Malware Hunting
40mMalware Reverse Engineering with PE Tree—OSS Inspired by COVID
42mBypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity Protectio