Mac-A-Mal: macOS malware analysis framework resistant to anti evasion techniques

Abstract

With macOS increasing popularity, the number, and variety of macOS malware are rising as well. Yet, very few tools exist for dynamic analysis of macOS malware. In this paper, we propose a macOS malware analysis framework called Mac-A-Mal. We develop a kernel extension to monitor malware behavior and mitigate several anti-evasion techniques used in the wild. Our framework exploits the macOS features of XPC service invocation that typically escape traditional mechanisms for detection of children processes. Performance benchmarks show that our system is comparable with professional tools and able to withstand VM detection. By using Mac-A-Mal, we discovered 71 unknown adware samples (8 of them using valid distribution certificates), 2 keyloggers, and 1 previously unseen trojan involved in the APT32 OceanLotus.

Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity

“…A behavior-based IPS/IDS or antivirus can detect obfuscated malware by applying a process-tracing technique [35]. However, if a malicious attacker applies a packing or protector technique to malware, it stops the antivirus; thus, a malicious attacker can bypass the behavior-based detection technique.…”

Resurrecting anti-virtualization and anti-debugging: Unhooking your hooks

“…Finally, if there is kernel-level access, approaches such as Mac-A-Mal [47] may efficiently detect evasion mechanisms. The corresponding system calls can be captured and dealt with appropriately to prevent the malware from identifying the existence of a virtual environment or a debugger.…”

Defeating Anti-Debugging Techniques for Malware Analysis Using a Debugger

“…proposed Mac-A-Mal, a framework for analyzing Mac based malware [27]. Pham et al developed a kernel extension to monitor malware behavior and bypass several evasion prevention techniques used in the wild, which uncovered 74 unknown malware programs.…”