Binary Facades: Reversing approaches to extract embedded scripts in compiled macOS malware

by Patrick Wardle

Day 2 · LVCC - L1 - Exhibit Hall West 3 · Track 4 · 20 min · 3 min read

Malware & Threat Intel Defensive Security

TL;DR

Malware authors wrap scripts in compiled macOS app bundles because targets double-click applications, not terminal commands. Patrick Wardle covers five packaging tools abused for this: Platypus, PyInstaller, Electron, Tauri, and AppleScript. Each leaves recognizable artifacts in the app bundle. Extracting the embedded script with package-specific tools yields human-readable code, skips binary reverse engineering, and defeats VM detection checks that block dynamic sandbox analysis. Malware families Creative Update, Eleanor, GravityRAT, and OSAMiner all used this technique.

The Case for Skipping Binary Reverse Engineering

▶ Watch (1:23)

When a malware analyst gets an unknown file, the first step is classification. Scripts are human-readable and quick to analyze. Compiled binaries need disassemblers and debuggers, which takes time. Some binaries are script runners. The actual malicious logic is a Python, JavaScript, or shell script embedded inside. Spending days reversing the loader binary wastes time on code that holds no malicious behavior. The script is the target, and it’s often extractable in minutes.

Platypus: When the Script Sits in the Resources Folder

▶ Watch (7:13)

Platypus is an open-source macOS tool that converts command-line scripts into app bundles. Its binary loader does one thing: run a script. That script sits in the app’s Resources directory in a file literally named “script.” No disassembler needed. Creative Update, a supply chain attack that Trojanized Firefox downloads via macupdate.com, used Platypus. Opening Resources revealed the first-stage shell script. Eleanor malware used the same packaging. Both were readable without any binary analysis.

PyInstaller and Electron: Compiled Scripts Need Extra Steps

▶ Watch (9:38)

PyInstaller converts Python scripts into macOS binaries. The strings utility reveals PyInstaller-specific strings like py_main. The embedded Python is compiled to bytecode, so extraction needs two steps: pyinstaller-extractor pulls the bytecode out, then uncompyle reconstructs the source. GravityRAT shipped as a PyInstaller binary. Electron apps embed JavaScript in compressed .asar archives. Running npx asar extract unpacks them. A second GravityRAT variant, built with Electron, checked for virtual machines before running. Static extraction bypassed that anti-analysis check.

Tauri and AppleScript: Rarer Packers, Same Approach

▶ Watch (14:14)

Tauri embeds everything directly in the main binary with no external dependencies. The strings utility exposes Tauri-referencing strings. Extraction uses a Brotli decompressor. Wardle generated the decompression script with ChatGPT. Running it against a Tauri malware sample extracted embedded JavaScript that fetched and executed a download payload. AppleScript malware compiles to a binary with an .scpt file in Resources and an executable named applet. OSAMiner used this format. The osadecompile tool fails on it, but a disassembler by Jynmo and a decompiler by Phil Stokes on GitHub reconstruct the AppleScript logic.

Notable Quotes

We didn’t have to open a disassembler. Patrick Wardle · ▶ 9:02

Awesome. Again, pretty trivial, right? Patrick Wardle · ▶ 9:34

Now I wasn’t super familiar with Tori. Patrick Wardle · ▶ 15:10

Key Takeaways

Check if a suspicious binary used Platypus, PyInstaller, Electron, Tauri, or AppleScript before opening a disassembler.
Each packaging tool leaves distinct artifacts: filenames, embedded strings, or framework dependencies that identify it.
Extracting the embedded script yields human-readable malicious logic and defeats in-binary VM detection checks.

About the Speaker(s)

Patrick Wardle is the founder of the Objective-See Foundation and CEO/cofounder of DoubleYou, where he builds core macOS detection components for security tools. He previously worked at NASA and the NSA. He is the author of “The Art of Mac Malware” book series, available free online, which covers the techniques discussed in this talk in greater depth. His research focuses on discovering Apple zero-days, analyzing macOS malware, and releasing open-source security tools for Mac users.

Filed under

Malware & Threat Intel Defensive Security