The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.
funzipfunzipSandbox: execFile · Timeout: 30s
security.execution.command extracts a ZIP or gzip file directly to output from archives or other piped input: funzip is a macOS utility used to extract ZIP or gzip files directly to output. Malicious binaries misuse funzip, along with head or tail, to extract and reconstruct password-protected malicious payloads.
tail -c <> $0 | funzip -<password>| Type | Rule / Indicator |
|---|---|
| other | No detections at time of publishing |
funzip is a macOS utility that extracts a ZIP or gzip file directly to output from archives or other piped input. The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.