# OSX.TinyShell variant 'TinyTim' analyzed

Published: 2020-06-01 · Severity: medium
Canonical: https://vorant.io/reports/7c7fc7cb-7c08-5f4c-8302-63a682ea6b29/osx-tinyshell-variant-tinytim-analyzed

> Researchers reverse-engineered a modified Tiny SHell macOS backdoor dubbed TinyTim, detailing its anti-debugging, XOR string obfuscation, and INI-style config format.

Objective-See researcher Jaron analyzed a macOS backdoor sample, a modified variant of the open-source Tiny SHell tool, naming it "TinyTim." First observed being used in targeted APT intrusions against Mac users (previously discussed in a 2018 "Macdoored" talk), the malware is dropped on victim systems via SSH using compromised credentials rather than through mass distribution. The sample is code-signed, possibly to blend in with legitimate signed macOS binaries and bypass Gatekeeper scrutiny.

Technically, TinyTim adds a custom XOR-based string decoding routine (MyDecode) to obfuscate sensitive strings including config file paths, C2 configuration keys, and the hardcoded backdoor password ("free&2015"). It also implements anti-debugging via ptrace(PT_DENY_ATTACH) and a self-connection check via strcmp to prevent trivial local testing. Configuration is read from an INI-style file at ~/Library/Fonts/.cache using a Windows-style GetProfileString port, with the C2 IP/domain stored XOR-encoded to evade static detection and YARA signatures. Beyond these additions, the malware's core functionality mirrors the open-source Tiny SHell backdoor, which operates similarly to SSH for remote shell access.

The researcher notes this malware family is rare but has been encountered multiple times in targeted intrusions over the years, including a 2013 Securelist report on a campaign targeting Uyghur Mac users. The low prevalence and reliance on stolen/compromised SSH credentials for deployment suggest continued use in narrowly targeted, likely espionage-motivated operations rather than broad commodity campaigns.

## Mentioned in this report

- Malware: OSX.Keydnap, Tiny SHell, TinyTim

Source reporting: https://objective-see.org/blog/blog_0x58.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7c7fc7cb-7c08-5f4c-8302-63a682ea6b29/osx-tinyshell-variant-tinytim-analyzed.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup