Analyzing a pirated application, that contains a (malicious) surprise

A few days ago, malwrhunterteam tweeted about pirated macOS application that appeared to contain malware

And even though as noted in the tweet the sample appeared to be from 2023, it was new to me so I decided to take some time to dig in deeper. Plus, I’m always interested in seeing if Objective-See’s free open-source tools can provide protection against recent macOS threats.

In this blog post we’ll start with the disk image, then hone in on a malicious dynamic library, which turns out just to be the start!