u/Few-Calligrapher2797

Picked up a low-VT AMOS sample on March 12 worth flagging. Aligns with the recent malext variants but layers a few things we haven't seen combined before:

• Custom multi-stage decryption (hex → ASCII → base64 via custom hash table) serving obfuscated osascript payloads at runtime — static analysis gets you almost nothing
• Anti-VM via system_profiler checking for QEMU/VMware/KVM processor strings and known sandbox hardware serials, run twice before payload delivery
• Payload written to /bin/zsh child process iteratively via write() loop — no plaintext payload on disk
• 300+ crypto extension IDs targeted + full desktop wallet scraping
• Hardware wallet trojanization — silently replaces Ledger, Trezor, and Exodus with adhoc-signed phishing lookalikes that harvest passwords and seed phrases to systellis[.]com
• Three-layer persistence: root LaunchDaemon (com.finder.helper) → ~/.mainhelper backdoor pulled from C2 → ~/.agent polling loop that pivots backdoor execution into the active console user's context every second via stat -f "%Su" /dev/console