A Better Way, YARA-X, Mach-O Feature Extraction, and Malware Similarity

Greg Lesnewich and Jacob Latonis of Proofpoint start from a practical gap: when an unknown macOS sample arrives, analysts usually pivot on strings, symbols and disassembly, which takes time. Windows analysts can pivot quickly on import hashes and rich header artifacts, and the speakers wanted comparable metadata pivots for Mach-O binaries. They frame the work around North Korean actors whose macOS and cryptocurrency-focused families they track, and they show how each family's developer habits can be visible even when the code changes.

The core of the talk is the set of Mach-O features the team built into the Mach-O module of YARA-X, a Rust rewrite of YARA. They parse dylib load commands, including timestamps and version fields, and hash the normalized, sorted list of library names in a way similar to import hashing. They also extract code signing entitlements from the signature blobs and hash those. Export tries and imports, which macOS stores as prefix trees and small state-machine encodings, can be read even when a binary is stripped. Case studies walk through AppleJeus-linked samples, Candy Corn, and TraderTraitor-related families, including first-stage loaders clustered by entitlement hash alone. The speakers also report retro hunting these rules against VirusTotal, where they found few hits for one rule.

The takeaway is that lightweight metadata similarity points to shared build preferences and developer habits, not to proven code overlap, so it works best as a selector that narrows a large set. The features are open source and usable from YARA rules or the Python package, and the speakers listed ongoing work such as linker option parsing and certificate parsing.