Before actual malicious code can be analyzed, it first needs to be obtained. Here is how it can be done, depending on the way it is distributed:
- 7-zip: This tool can be used to extract actual executables from both DMG and IPA packages:
Figure 5: Looking inside the DMG file
While it is possible to extract some files from .deb packages using this tool, a more reliable way here is to use the standard ar tool with x argument: ar x <sample>.deb.
- iTunes: If the apps of interest are hosted on the App Store, the easiest way to get them is to use iTunes before version 12.7. It is still available on the official website for certain business needs. Once downloaded, they can be found in the Mobile Applications subdirectory.
- iMazing: This commercial third-party alternative to iTunes can be used to manage apps from the official App Store and get app data from the device without jailbreaks.