SentinelLabs reversing run-only applescripts 2021

macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.

macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.

macOS.OSAMiner has used `ps ax | grep <name> | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery.

macOS.OSAMiner has used `osascript` to call itself via the `do shell script` command in the Launch Agent `.plist` file.

macOS.OSAMiner can gather the device serial number.

macOS.OSAMiner can parse the output of the native `system_profiler` tool to determine if the machine is running with 4 cores.

macOS.OSAMiner has placed a Stripped Payloads with a `plist` extension in the Launch Agent's folder.

macOS.OSAMiner has used `launchctl` to restart the Launch Agent.

macOS.OSAMiner has checked to ensure there is enough disk space using the Unix utility `df`.

macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's `install.log` for apps matching its hardcoded list, killing all matching process names.