OSX.TinyShell variant 'TinyTim' analyzed

1 June 2020 routine threat

Researchers reverse-engineered a modified Tiny SHell macOS backdoor dubbed TinyTim, detailing its anti-debugging, XOR string obfuscation, and INI-style config format.

Objective-See researcher Jaron analyzed a macOS backdoor sample, a modified variant of the open-source Tiny SHell tool, naming it "TinyTim." First observed being used in targeted APT intrusions against Mac users (previously discussed in a 2018 "Macdoored" talk), the malware is dropped on victim systems via SSH using compromised credentials rather than through mass distribution. The sample is code-signed, possibly to blend in with legitimate signed macOS binaries and bypass Gatekeeper scrutiny.

Technically, TinyTim adds a custom XOR-based string decoding routine (MyDecode) to obfuscate sensitive strings including config file paths, C2 configuration keys, and the hardcoded backdoor password ("free&2015"). It also implements anti-debugging via ptrace(PT_DENY_ATTACH) and a self-connection check via strcmp to prevent trivial local testing. Configuration is read from an INI-style file at ~/Library/Fonts/.cache using a Windows-style GetProfileString port, with the C2 IP/domain stored XOR-encoded to evade static detection and YARA signatures. Beyond these additions, the malware's core functionality mirrors the open-source Tiny SHell backdoor, which operates similarly to SSH for remote shell access.

The researcher notes this malware family is rare but has been encountered multiple times in targeted intrusions over the years, including a 2013 Securelist report on a campaign targeting Uyghur Mac users. The low prevalence and reliance on stolen/compromised SSH credentials for deployment suggest continued use in narrowly targeted, likely espionage-motivated operations rather than broad commodity campaigns.

Mentioned in this report

Malware OSX.KeydnapTiny SHellTinyTim

Detection guidance

macOS Debugger Evasion via ptrace PT_DENY_ATTACH

ATT&CK T1622

Detects process calling ptrace with PT_DENY_ATTACH flag to prevent debugging—common in TinyTim and other macOS backdoors. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Debugger Evasion via ptrace PT_DENY_ATTACH
description: Detects ptrace syscall with PT_DENY_ATTACH to disable debugger attachment.
  Used by TinyTim and similar macOS backdoors to evade dynamic analysis.
tags:
- attack.defense-evasion
- attack.t1622
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains: PT_DENY_ATTACH
  condition: selection
falsepositives:
- Legitimate software development tools applying anti-debugging protections
level: medium
id: e37a14de-0864-57a8-ac05-9290f83c57ce
status: experimental
author: Vorant

SSH Access with Suspicious Shell Invocation on macOS

ATT&CK T1021.004

Detects SSH session spawning a custom shell binary—consistent with TinyTim remote shell deployment via compromised credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: SSH Access with Suspicious Shell Invocation on macOS
description: Detects sshd spawning non-standard shell binaries, typical of TinyTim
  and similar backdoors deployed via compromised SSH credentials for remote shell
  access.
tags:
- attack.lateral-movement
- attack.t1021.004
- attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains: sshd
    Image|endswith:
    - /bin/bash
    - /bin/sh
    - /bin/zsh
    CommandLine|contains:
    - -c
    - -i
  filter_standard_shell:
    Image|endswith:
    - /bin/bash
    - /bin/sh
  condition: selection and not filter_standard_shell
falsepositives:
- Legitimate SSH shell sessions using alternative interpreters
- Automation scripts deploying custom shells via SSH
level: medium
id: ec4206b3-9382-54df-bb80-db1f147823f7
status: experimental
author: Vorant

Configuration File Access from Library Fonts Cache on macOS

ATT&CK T1027

Detects process reading obfuscated configuration file from ~/Library/Fonts/.cache—TinyTim's INI-style config storage location. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Configuration File Access from Library Fonts Cache on macOS
description: Detects file access to ~/Library/Fonts/.cache directory, used by TinyTim
  to store XOR-obfuscated C2 configuration and hardcoded credentials to evade static
  detection.
tags:
- attack.defense-evasion
- attack.t1027
- attack.t1140
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains: Library/Fonts/.cache
    EventType:
    - CreateKey
    - WriteFile
    - ReadFile
  filter_fonts_cache_legitimate:
    Image|contains:
    - fontd
    - FontBook
  condition: selection and not filter_fonts_cache_legitimate
falsepositives:
- Legitimate font caching utilities accessing Library/Fonts directories
level: high
id: 64e8e835-b68d-54b4-a1a4-95a139a4327e
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x58.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free