Anti Analysis Logic of Arm Malware on macOS

Apple's M1 chips run native arm64 code, so malware compiled for them is becoming a real concern on macOS. The talk explains how universal binaries carry both Intel and arm64 code, and how a VirusTotal search surfaced what appears to be the first Mac malware sample built natively for Apple Silicon. That sample, a variant of a known family, had been submitted by a user of an open-source tool.

Before analyzing it, the presenter covers the arm64 essentials a reverser needs: general purpose registers and their 32-bit halves, the calling convention that passes early arguments in x0 through x7, the link register, the load and store model, condition flags and branch types. A short Objective-C hello world program ties these ideas to real disassembly. The malware resists decompilation because its code is padded with junk instructions and spurious calls, so the analysis relies on reading assembly directly.

The sample carries several anti-analysis checks. A ptrace call with the deny-attach flag makes it exit under a debugger; the talk bypasses this by breaking on the supervisor call and skipping it. The other checks, which look for disabled System Integrity Protection and for virtual machines, are identified by inspecting Objective-C message sends in a debugger, revealing that they shell out to a system utility and to a virtualization-detection script. The takeaway is that a modest arm64 foundation is enough to get past anti-analysis, after which passive process and file monitors can show what the sample actually does.