Tearing Apart the Undetected (OSX)Coldroot RAT
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
The post walks through the reverse-engineering of com.apple.audio.driver.app, an unsigned, UPX-packed, Free Pascal-compiled macOS binary that references TCC.db to grant itself accessibility rights, masquerades as a document with a fake credential prompt, persists via a launch daemon, and beacons to a command server.