Overall, Silver Sparrow is interesting and unique because: Although we never observed Silver Sparrow delivering additional malicious payloads, it was operationally mature and affected many thousands of machines worldwide. Thanks to our friends at MalwareBytes, we determined that the Silver Sparrow activity cluster affected tens of thousands of macOS endpoints across 164 countries as of February 2021, including high volumes of detection in the United States, the United Kingdom, Canada, France, and Germany. _insu file that seems to instruct the malware to remove itself from an endpoint. Since we observed multiple files and components on victim machines, we decided to cluster all the suspicious artifacts under the Silver Sparrow activity cluster, including an unusual. These files attempted to download a future payload determined by a file from an additional S3 bucket retrieved every hour. During installation, the malware executed JavaScript commands to orchestrate the creation of files and scripts for persistent execution.

The downloader was novel because of the way it used JavaScript for execution and the appearance of a related binary compiled for Apple’s new M1 ARM64 architecture. We analyzed two versions of Silver Sparrow malware: The first version contained a Mach-O binary compiled for Intel x86_64 architecture only, and the second version included a Mach-O binary compiled for Intel x86_64 and M1 ARM64 architectures. Distributed via downloads from AWS S3 buckets, malware dropped by Silver Sparrow relies on installation through macOS PKG files.

In February 2021, Red Canary discovered an activity cluster we named Silver Sparrow when we identified a strain of macOS malware using a LaunchAgent to establish persistence. Editors’ note: While the analysis and detection opportunities remain applicable, this page has not been updated since 2022.

Malwarebytes m1