When analyzing malware that is targeting Apple systems (whether it is macOS or iOS), the following workflow can be used:
- Understand the indicators of compromise available. Is it possible that they are related to activity that doesn't involve the usage of malicious code?
- Once the candidate for a malicious sample is identified, start by obtaining it and any related files and performing static analysis.
Follow these steps in the static analysis stage:
- If there are multiple files available within one bundle, find out which one is supposed to be executed first. For macOS, this is defined in the Info.plist file in the CFBundleExecutable field, and for iOS, it will be an executable that has the same name as the bundle, but without the .app extension.
- Carefully review the strings and import functions involved, as they may offer some insight into the malware's functionality. Pay particular attention to the import functions mentioned in the File Formats and APIs section...