macOS Malware Analysis: The __c5cfg Enigma Reverse-engineered a suspicious x86_64 macOS binary, uncovering a custom Mach-O section, syscall activity, potential in-memory BOF loading, and C2 indicators. t.co/duLtoKTodl #MalwareAnalysis #ReverseEngineering t.co/hFI7BF4rnN
@c_kant_ For the in-memory loading angle, check whether NSCreateObjectFileImageFromMemory / NSLinkModule show up in the imports or strings. That's the classic API path for loading a Mach-O from memory on macOS. Did you spot that, or does it use a custom loader?
@V0iD_0daY Neither of those appears in the imports or strings. In fact, this sample implements its own custom loader.
