TW / Independent
← Research audits

Malware Analysis / Artefact: Slack-Apps.dmg · SHA-256 18bc97e3f688…

Atomic Stealer: macOS password prompts, browser data and wallet artifacts

Version-bound macOS analysis of malvertising, DMG social engineering, string obfuscation and collection from browsers, Keychain and wallets.

Scope
Malwarebytes comparison of Atomic Stealer samples before and after the December 2023 update plus an observed malvertising campaign.
Method
Static source and architecture review; no malware obtained, built or executed.
Evidence
Published sample identity; binary not present in the local evidence set.
Finding

Delivery, the obfuscation change and target artifacts are documented; current campaigns and variants remain open.

No independent sample, runtime, C2 or campaign verification.

Analyst note

What the evidence actually supports.

Atomic Stealer turns a familiar macOS flow against the user: open, persuade, request a password. We treat the published hash as an identity, not as a claim that the DMG was dissected locally.

Evidence anchorpublished identity
Artefact
Slack-Apps.dmg
SHA-256
18bc97e3f68864845c719754d2d667bb03f754f6e87428e33f9c763a8e6a704a
Analysis basis
Published sample identity; binary not present in the local evidence set.
Malware / Evidence Atlas

Deceptive download → Network boundary

The analysis path for this report. Every node shows what is supported, where detection can start and where the claim stops.

5flow nodes 2detection artefacts 2rule formats
Claim

Deceptive download

The documented campaign disguises the macOS download as an expected application.

Detection focus

Review download origin, quarantine attribute and signing state.

Bound to primary research
Config Surface

Configuration fingerprint

Review pivots derived from the report — not a live configuration or universal family indicator.

01
Luredisk image / app
support
02
Dialog pathAppleScript
core
03
Data storesbrowser / keychain
core
04
Exfiltrationsource-bound
boundary
MODEL / D540E0ADCore, support and boundary — not risk scores
Detection Pack

Defensive artefacts

Source, validation and limits accompany every rule.

SourceOriginal derivation from the reported behaviour chain.ValidationParsed by pySigma; synthetic truth table 3/3.LimitAppleScript password prompts also occur in legitimate utilities.
SigmaOpen rule
Defensive model
title: AMOS credential-prompt chain candidate
status: experimental
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains:
      - 'display dialog'
      - 'hidden answer'
    ParentImage|contains: '/Volumes/'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity with the same isolated pattern
level: medium

Evidence status Supported by review evidenceBound to primary researchBounded or unresolved

Scope, snapshot and evidence boundary

Malwarebytes comparison of Atomic Stealer samples before and after the December 2023 update plus an observed malvertising campaign. The bounded question is: which architecture and behaviour claims does this specific evidence set support, and which remain attributable only to the source?

What is supported — and what is missing

Primary sources, statically inspectable code and runtime observations carry different evidentiary weight. The map keeps those layers separate; missing first-party observation is not replaced by plausibility.

FILE / EVIDENCE MAP

Evidence chain and open runtime gap

The map separates primary source, reproducible source snapshots and runtime evidence not collected here.

A file reference does not establish runtime behaviour. Recorded processing is not a new execution.

SourceToolDerivedEvidenceMissingVerified referenceRecordedUnresolved

Evidence

Traceable source with an explicit sample gap.

Primary source

Published analysis or pinned upstream snapshot.

  • Primary source → Documented observationsdocumented by source · Recorded

    Not independently replayed against a sample here.

Related report section →
Documented observations

Sample, sandbox or telemetry claims made by the source.

  • Primary source → Documented observationsdocumented by source · Recorded

    Not independently replayed against a sample here.

  • Documented observations → No local malware sampleruntime unresolved · Unresolved

    The review remains static or source-bound.

Related report section →
No local malware sample

No first-party runtime, C2 or campaign telemetry.

  • Documented observations → No local malware sampleruntime unresolved · Unresolved

    The review remains static or source-bound.

Related report section →

Limit: A published observation is not an independent reproduction.

Entry and delivery chain

The observed campaign began with a search advertisement impersonating Slack, passed through several redirects and offered Windows and macOS payloads. The macOS branch delivered a DMG with instructions for manual execution. This is social engineering, not automatic bypass of platform boundaries.

Architecture and data flow

The December update obscured previously visible strings, including browser, wallet and C2 references. The DMG application displays a password prompt to gain access to protected data. Browser cookies, passwords, Keychain and wallet artifacts are treated as separate data classes.

Analysis resistance and persistence

String obfuscation reduced simple static detection. Brand impersonation, user instructions and the appearance of a legitimate password prompt shift part of evasion into interaction. A password prompt alone is not suspicious on macOS; origin, signing and follow-on access provide context.

Capabilities, objective and impact

Stolen cookies can enable session takeover, Keychain entries can expose credentials and wallet files can create financial impact. Presence of a target path proves neither successful access nor actual exfiltration; file and network evidence are required.

Telemetry plan and evidence chain

On macOS, defenders should connect Gatekeeper/quarantine origin, signature status, DMG mount, unusual password prompts, access to multiple browser profiles or Keychain and timely outbound connections. Older plaintext strings are weaker after the update. A defensible investigation preserves process GUID and full ancestry, user and session, command line, signer and hash state, file and registry changes, DNS/connection destinations and follow-on access to sensitive data in one timeline. Temporal proximity is an evidence parameter, not mere visualization. Missing sensor coverage is marked per stage so that an unseen event is not falsely treated as an event that did not occur.

Detection engineering and countertesting

On macOS, defenders should connect Gatekeeper/quarantine origin, signature status, DMG mount, unusual password prompts, access to multiple browser profiles or Keychain and timely outbound connections. Older plaintext strings are weaker after the update. The following model is deliberately narrow, not engine-validated and must be tested against legitimate administration and software paths.

yamlDefensive model, not engine-validatedDefensive model
title: AMOS credential-prompt chain candidate
status: experimental
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains:
      - 'display dialog'
      - 'hidden answer'
    ParentImage|contains: '/Volumes/'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity with the same isolated pattern
level: medium
Read the code

Alternative hypotheses and negative tests

Before assigning the family, each signal used by the model is tested independently against software deployment, administration tools, installers, browser or backup software and known internal scripts. At least one structural anchor and one temporally consistent behaviour chain must align. The analysis is bound to samples and a campaign from late 2023/early 2024. C2 addresses and string features are historical; source sandbox observations are not an independent reproduction. A negative countercheck rejects only the tested hypothesis; it is not a general all-clear.

Attribution and variant risk

The analysis is bound to samples and a campaign from late 2023/early 2024. C2 addresses and string features are historical; source sandbox observations are not an independent reproduction.

Final assessment

The review provides a defensible architecture and detection baseline for the named snapshot. It is not proof of current activity, complete variant coverage or a specific operator.

Findings at a glance

  • The attack combines brand impersonation with manual DMG execution.
  • The update shifted detection from plaintext strings to behaviour and data access.
  • Cookies, Keychain and wallets have different evidence and impact boundaries.

Review limits

  • No independent sample, runtime, C2 or campaign verification.
  • The analysis is bound to samples and a campaign from late 2023/early 2024. C2 addresses and string features are historical; source sandbox observations are not an independent reproduction.
  • Defensive models were not validated with a target engine.

Context, not evidence

The Evidence Anchor at the start identifies the binary, file or revision actually used. These links provide context and reported observations; they do not substitute for local sample analysis.

Malwarebytes — Atomic Stealer updated version ↗
Final assessment

Conclusion

Conclusion: structure before signature

The greatest defensive value comes from connecting entry, internal architecture, persistence, impact and telemetry. Individual names, hashes or IOCs remain supporting evidence, not the conclusion.

Next steps

  • Test models against synthetic positives and legitimate negatives.
  • Rebind version and evidence snapshot with every update.
  • Extend runtime claims only after first-party, lawfully available telemetry.
Basis of this judgmentHigh for directly inspectable structure; limited for runtime and campaign claims not independently reproduced.
Malwarebytes comparison of Atomic Stealer samples before and after the December 2023 update plus an observed malvertising campaign.
← All research audits

Start a conversation

Discuss your project.

Start a conversation