Offensive Malware Analysis: Dissecting OSX FruitFly

Discovery of the FruitFly Spyware

Patrick Wardle analyzes FruitFly, a stealthy macOS malware family that selectively compromised biomedical research institutions and academic targets while remaining undetected by commercial antivirus products for several years. The presentation focuses on the B variant of FruitFly, examining its custom evasion tradecraft and unique architectural components.

Deconstructing the Obfuscated Perl Dropper

The initial triage of the malware examines its primary dropper, which unusually relies on an obfuscated Perl script embedded within an application wrapper. Wardle breaks down the deobfuscation process, reconstructing the script's memory-resident staging routines, internal variable decoding, and execution flow that drops a native Mach-O binary payload onto the victim machine.

Standing Up a Custom Command and Control Server

Rather than undertaking months of tedious static binary disassembly, Wardle demonstrates an offensive malware analysis approach: standing up a custom command-and-control (C2) server to interact directly with infected hosts and stimulate latent capabilities. By observing protocol handshakes and reverse engineering network packet structures, researchers can command the live malware binary to trigger individual functionality in controlled sandbox environments.

Stimulating Hidden OS Level Capabilities

Using the custom C2 framework, Wardle maps out the extensive spying features of FruitFly, including remote screen capture, webcam activation, microphone recording, and synthetic mouse event injection using low-level CoreGraphics and I/O Kit APIs. To verify the malware's control over user interface events, Wardle details the creation of a custom mouse-sniffer tool that decodes synthetic event messages sent by the malware to the operating system, demonstrating how active protocol manipulation accelerates comprehensive reverse engineering.