Sometimes adversaries bring in their own tools, and if they leave behind a VM disk, analysis is fair game. In this post we look at some tools an adversary brought during a social engineering campaign.
It's not just you, most of the macOS stealers look the same nowadays, but there are subtle differences between stealer families to tell them apart. If you're a stickler for detail like us, you might enjoy this post showing differences between the malware.
Do you miss @cobaltstrikebot? If so, here's a blog post showing how you can pull Cobalt Strike SpawnTo and watermark info with @shodanhq and some PowerShell: