OSX.TinyShell variant 'TinyTim' analyzed
Researchers reverse-engineered a modified Tiny SHell macOS backdoor dubbed TinyTim, detailing its anti-debugging, XOR string obfuscation, and INI-style config format.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Objective-See researcher Jaron analyzed a macOS backdoor sample, a modified variant of the open-source Tiny SHell tool, naming it "TinyTim." First observed being used in targeted APT intrusions against Mac users (previously discussed in a 2018 "Macdoored" talk), the malware is dropped on victim systems via SSH using compromised credentials rather than through mass distribution. The sample is code-signed, possibly to blend in with legitimate signed macOS binaries and bypass Gatekeeper scrutiny.
Technically, TinyTim adds a custom XOR-based string decoding routine (MyDecode) to obfuscate sensitive strings including config file paths, C2 configuration keys, and the hardcoded backdoor password ("free&2015"). It also implements anti-debugging via ptrace(PT_DENY_ATTACH) and a self-connection check via strcmp to prevent trivial local testing. Configuration is read from an INI-style file at ~/Library/Fonts/.cache using a Windows-style GetProfileString port, with the C2 IP/domain stored XOR-encoded to evade static detection and YARA signatures. Beyond these additions, the malware's core functionality mirrors the open-source Tiny SHell backdoor, which operates similarly to SSH for remote shell access.
The researcher notes this malware family is rare but has been encountered multiple times in targeted intrusions over the years, including a 2013 Securelist report on a campaign targeting Uyghur Mac users. The low prevalence and reliance on stolen/compromised SSH credentials for deployment suggest continued use in narrowly targeted, likely espionage-motivated operations rather than broad commodity campaigns.
Mentioned in this report
Detection guidance
macOS Debugger Evasion via ptrace PT_DENY_ATTACH
A behavioural hunt for the technique in general.
Detects process calling ptrace with PT_DENY_ATTACH flag to prevent debugging—common in TinyTim and other macOS backdoors. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Debugger Evasion via ptrace PT_DENY_ATTACH
description: Detects ptrace syscall with PT_DENY_ATTACH to disable debugger attachment.
Used by TinyTim and similar macOS backdoors to evade dynamic analysis.
tags:
- attack.stealth
- attack.t1622
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains: PT_DENY_ATTACH
condition: selection
falsepositives:
- Legitimate software development tools applying anti-debugging protections
level: medium
id: e37a14de-0864-57a8-ac05-9290f83c57ce
status: experimental
author: Vorant
SSH Access with Suspicious Shell Invocation on macOS
A behavioural hunt for the technique in general.
Detects SSH session spawning a custom shell binary—consistent with TinyTim remote shell deployment via compromised credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Access with Suspicious Shell Invocation on macOS
description: Detects sshd spawning non-standard shell binaries, typical of TinyTim
and similar backdoors deployed via compromised SSH credentials for remote shell
access.
tags:
- attack.lateral-movement
- attack.t1021.004
- attack.t1059.004
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|contains: sshd
Image|endswith:
- /bin/bash
- /bin/sh
- /bin/zsh
CommandLine|contains:
- -c
- -i
filter_standard_shell:
Image|endswith:
- /bin/bash
- /bin/sh
condition: selection and not filter_standard_shell
falsepositives:
- Legitimate SSH shell sessions using alternative interpreters
- Automation scripts deploying custom shells via SSH
level: medium
id: ec4206b3-9382-54df-bb80-db1f147823f7
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x58.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs