GravityRAT macOS variant abuses Electron for C2
Objective-See's analysis of GravityRAT's macOS 'StrongBox' binary reveals an Electron-based downloader that checks for VMs, requests Full Disk Access, and persists 2nd-stage payloads via cron.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This is the second part of Objective-See's deep-dive into a macOS variant of GravityRAT, focusing on the StrongBox sample—one of several near-identical PyInstaller-packaged binaries (alongside OrangeVault, TeraSpace, and previously analyzed Enigma). Unpacking StrongBox reveals an Electron application whose bundled JavaScript (main.js and signature.js) performs anti-analysis checks: it queries system_profiler output to detect VM indicators (VMware, VirtualBox, Hyper-V, Hitachi), verifies internet connectivity by pinging google.com, and checks for Full Disk Access by attempting to list ~/Library/Safari, prompting the user via a fake dialog if access is denied.
The malware's core functionality is a downloader: it beacons to a hardcoded C2 (download.strongbox.in) every three minutes to fetch updates, extracts the downloaded zip archive into ~/Library/Application Support/SCloud, and persists the second-stage payload as a cron job scheduled to execute every two minutes. At the time of analysis, the C2 domain was offline, preventing collection of the second-stage payload. The analysis reinforces prior Kaspersky reporting that GravityRAT's Windows/macOS Electron variants collect system information, perform VM detection, and establish persistence via scheduled tasks.
No specific victim sectors or active campaign are named in this technical writeup; the focus is purely on reverse-engineering the sample's behavior for detection and defense purposes, including demonstrating that objective-see's BlockBlock and KnockKnock tools can detect the cron persistence and existing infections respectively.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x5C.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs