GravityRAT macOS variant abuses Electron for C2

Objective-See's analysis of GravityRAT's macOS 'StrongBox' binary reveals an Electron-based downloader that checks for VMs, requests Full Disk Access, and persists 2nd-stage payloads via cron.

This is the second part of Objective-See's deep-dive into a macOS variant of GravityRAT, focusing on the StrongBox sample—one of several near-identical PyInstaller-packaged binaries (alongside OrangeVault, TeraSpace, and previously analyzed Enigma). Unpacking StrongBox reveals an Electron application whose bundled JavaScript (main.js and signature.js) performs anti-analysis checks: it queries system_profiler output to detect VM indicators (VMware, VirtualBox, Hyper-V, Hitachi), verifies internet connectivity by pinging google.com, and checks for Full Disk Access by attempting to list ~/Library/Safari, prompting the user via a fake dialog if access is denied.

The malware's core functionality is a downloader: it beacons to a hardcoded C2 (download.strongbox.in) every three minutes to fetch updates, extracts the downloaded zip archive into ~/Library/Application Support/SCloud, and persists the second-stage payload as a cron job scheduled to execute every two minutes. At the time of analysis, the C2 domain was offline, preventing collection of the second-stage payload. The analysis reinforces prior Kaspersky reporting that GravityRAT's Windows/macOS Electron variants collect system information, perform VM detection, and establish persistence via scheduled tasks.

No specific victim sectors or active campaign are named in this technical writeup; the focus is purely on reverse-engineering the sample's behavior for detection and defense purposes, including demonstrating that objective-see's BlockBlock and KnockKnock tools can detect the cron persistence and existing infections respectively.

Source reporting: https://objective-see.org/blog/blog_0x5C.html