FruitFly's dropper script and its missing tricks

Note to original post:
This post was originally written back in May 2019 but was removed because of “pressure” from my employer at the time, Apple. It was written over the weekend on my own equipment and was all about information I had way before I joined Apple. Personally I don’t think there is any special drama here other than unreleased technical details about a malware that is dead and its author busted long time ago. When paranoia and envy are dominant then everything can be a potential media drama in people’s mind. It’s all bullshit. My position didn’t change and given that there is an upcoming presentation about this malware by Thomas Reed at Objective By The Sea it’s time to re-release this.

While sorting out my Mac malware collection I found out that I had an unreleased (no known public references) FruitFly/Quimitchin dropper script lost in my archives.

FruitFly made big headlines two years ago and its author has been arrested. It was first reported by MalwareBytes and then a new variant was analysed by Patrick Wardle. Besides being under the radar for more than a decade, it was kind of exotic malware because most of its code was written in Perl. Last time I did something serious in Perl was twenty years ago or so!

It turns out that two years ago @noarfromspace sent me some FruitFly related files, which I stored but never bothered to look at. While sorting out all related files to FruitFly I finally took a peek inside this file because its hash wasn’t mentioned anywhere else.
It is available on VirusTotal with the following SHA256 hash 4df135fd0fcfe3800d5043985ad1be349bd10da5b63a0ef42531e95452d102c7.

This script is responsible for downloading the 2nd stage malicious payload (a Perl script that contains a malicious Mach-O and other files) and creating the persistent LaunchAgent. Executed without arguments it shows the available options:

$ perl dropper.pl 
Usage: dropper.pl [-b] [-u USERNAME] FILE

-b   blocks the original program so it can't run and exit
-u USERNAME  sets the username and the given directory should contain a
             Library/LaunchAgents
FILE can end in /APPNAME.app to automatically append /Contents/MacOS/APPNAME
FILE can end in /Users/USERNAME to do a user (can use "~" on command line)
FILE can end in /+fpsaud to treat up to / as the main drive root and create a
     root infection

FruitFly available public analysis describes persistency only at user level