AMOS Stealer Anti-VM Evasion via System Profiler
Detects the execution of an osascript command that queries system_profiler for SPMemoryDataType and checks for virtualization software strings like QEMU or VMware. This technique is actively used by the Atomic macOS Stealer (AMOS) to evade automated analysis environments and sandboxes.
Sigma
