Mac-A-Mal: An Automated Platform for Mac Malware Hunting
summary
Mac-A-Mal is an automated macOS malware analysis platform built on Cuckoo that runs macOS guests on VMware/VirtualBox/QEMU, hooks kernel syscalls to capture behavior, and patches kernel state patch-on-the-fly anti-VM mitigation to hide virtualization. It processes large datasets (2,000+ samples), finds 100+ additional malicious binaries in one campaign, reports 85% adware and 86 families, extracts certificates and network indicators, and includes an automated GUI auth solver and kernel-level syscall hooking to make dynamic tracing reliable.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:32Malware analysis for macOS
- 2:21Mac-A-Mal static analysis
- 4:08Mac-A-Mal dynamic analysis
- 5:58Any sample types are supported
- 8:06Kernel-space monitor
- 9:23Detect evasion techniques & mitigation
- 10:50(no) Human Interaction
- 11:58OSX/Mughthesec
- 13:32On large scale
- 14:36macOS malware evolution
- 15:57Summary
related talks
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
22mMalware Hunting - Using python as an attack weapon
21mAutomating dynamic malware analysis
27mA Machine Learning approach for detecting a Malware
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads