Do as I say, Not as I did: Pivoting into Mac Malware Analysis for the 1st Time

K. Del Rosso, who had no prior experience with macOS internals, documents an attempt to learn Mac malware analysis from scratch. The talk starts by urging analysts to define their goal first, whether that is incident response triage, threat intelligence tracking or deeper research, so the work does not drift into low-level detail that fails to answer the question. It then separates static analysis, which inspects files without running them, from dynamic analysis, which executes samples in a controlled environment.

Building a working lab proved hard. Virtualization products that suited older Intel Macs were troublesome on Apple silicon, and built-in protections such as quarantine and Gatekeeper made older macOS installers difficult to obtain. Once a sample was open, the talk walked through the app bundle: the code signature, useful for developer pivots; the info property list, with settings such as a flag that hides the app from the Dock or login-item hooks; the resources folder; and the Mach-O executable. Quick checks included reading signing details, pulling readable strings with tools such as FLOSS, and spotting oddities like a file named as text that carried executable permissions. Packers and string obfuscation were flagged as common hindrances.

The closing section covered the time needed to learn the skill, suggesting a structured reading path, hands-on practice and simple command-line and GUI utilities for triage. The main takeaway is that a useful high-level picture can come from inspecting a bundle before opening a disassembler, while assembly and deeper reversing remain necessary for full analysis.