Executed without arguments it shows the available options: This script is responsible for downloading the 2nd stage malicious payload (a Perl script that contains a malicious Mach-O and other files) and creating the persistent LaunchAgent. While sorting out all related files to FruitFly I finally took a peek inside this file because its hash wasn’t mentioned anywhere else. It turns out that two years ago sent me some FruitFly related files, which I stored but never bothered to look at. Last time I did something serious in Perl was twenty years ago or so! Besides being under the radar for more than a decade, it was kind of exotic malware because most of its code was written in Perl. It was first reported by MalwareBytes and then a new variant was analysed by Patrick Wardle. While sorting out my Mac malware collection I found out that I had an unreleased (no known public references) FruitFly/Quimitchin dropper script lost in my archives.įruitFly made big headlines two years ago and its author has been arrested. My position didn’t change and given that there is an upcoming presentation about this malware by Thomas Reed at Objective By The Sea it’s time to re-release this. When paranoia and envy are dominant then everything can be a potential media drama in people’s mind. Personally I don’t think there is any special drama here other than unreleased technical details about a malware that is dead and its author busted long time ago.

It was written over the weekend on my own equipment and was all about information I had way before I joined Apple. This post was originally written back in May 2019 but was removed because of “pressure” from my employer at the time, Apple.

Fpsaud