iOS Malware Detection Workflow using MVT (Mobile Verification Toolkit)

This workflow is intended to guide students and digital forensics practitioners through the structured process of analyzing iOS filesystem images for potential spyware infections using MVT (Mobile Verification Toolkit). It details every key stage—from environment setup to confirming detection results—with references to useful resources.

The objective of this workflow is to empower investigators to systematically verify signs of mobile device compromise using MVT. Although MVT was developed by Amnesty International’s Security Lab to detect targeted attacks such as Pegasus spyware, it is extensible to any STIX2-based indicators of compromise (IOCs).

• Ensure you're working on a Linux system (e.g., Kali, Ubuntu).
• Create and activate a Python virtual environment:

  python3 -m venv leapp-env
  source leapp-env/bin/activate

• Install MVT and dependencies:

  pip install mvt
  pip install mvt-ios

• Reference: Official MVT Installation Guide

• Obtain the full logical image or filesystem dump from an iOS device.
• Unzip or extract the image to a known directory, for example:

  unzip device_image.zip -d /media/user/extracted/filesystem1

• MVT comes bundled with public IOCs in STIX2 format, which are auto-downloaded.
• IOC directory is usually located in:

  ~/.local/share/mvt/indicators/
  

• Reference IOC sources:
  • Amnesty Tech Investigations
  • MVT Sample IOC Files

• Command to analyze the filesystem:

  mvt-ios check-fs --input /media/user/extracted/filesystem1 --output ~/Documents/mvt_results

• This will analyze the extracted filesystem against all known indicators.

The scan produces results in the mvt_results directory. Key output files include:

• filesystem_detected.json: Matches of IOC files
• timeline_detected.csv: Time-aligned matches
• applications.json: List of apps discovered

Important: If any detections are made, there will be files with a _detected.* suffix (e.g., filesystem_detected.json, timeline_detected.csv) in the output folder. These are the files you must examine to investigate possible compromises.

Use the following command to review detections:

jq '.' filesystem_detected.json

Look for fields like:

"matched_indicator": {
  "value": "payload",
  "type": "processes",
  "name": "Pegasus"
}

Use find to locate files named in detections:

find /media/user/extracted/filesystem1 -type f -iname "payload"

Verify file type using:

file <path_to_payload>

Example:

file "/media/user/extracted/filesystem1/private/var/mobile/.../payload"

Check if the file hash matches any known samples:

sha256sum <path_to_file>

You can then lookup these hashes on threat intelligence platforms such as:

• VirusTotal
• Hybrid Analysis
• MalShare

Use jq for JSON files:

jq '.' <file>

Use strings for binary files:

strings <file>

Review timeline_detected.csv to align suspicious activity with timestamps.

cat timeline_detected.csv

This helps establish when each detection occurred and whether it coincides with user activity.

In our example:

• Two files named payload matched Pegasus indicators.
• One was confirmed as a benign Uber shuttle advertisement JSON file.
• The other, a Smartlook SDK capture, was also not inherently malicious.

Thus, both detections were false positives, likely flagged due to the generic use of "payload" in filenames.

• Always inspect files before drawing conclusions from tool alerts.
• Validate matches using hashes and VirusTotal if needed.
• Correlate findings with app usage data and network activity.
• Leverage multiple sources to support your conclusion.

• MVT GitHub: https://github.com/mvt-project/mvt
• STIX Viewer: https://oasis-open.github.io/cti-documentation/stix/intro.html
• JQ Command Reference: https://stedolan.github.io/jq/manual/
• File command usage: https://linux.die.net/man/1/file
• Strings command usage: https://linux.die.net/man/1/strings
• VirusTotal Lookup: https://www.virustotal.com/
• Hybrid Analysis: https://www.hybrid-analysis.com/

This workflow emphasizes cautious validation. MVT is a strong tool for identifying indicators, but each alert must be verified in forensic context. Encourage collaboration with experienced analysts where possible.

For advanced correlation, integrate timelines with system logs and application usage to reconstruct user behavior.

This workflow is intended for educational and investigative purposes in digital forensics.