Procedure examples

MacMa can collect then exfiltrate files from the compromised system.

MacMa can collect IP addresses from a compromised host.

MacMa can manage remote screen sessions.

MacMa can collect the username from the compromised machine.

MacMa exfiltrates data from a supplied path over its C2 channel.

MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.

MacMa can enumerate running processes.

MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.

MacMa can delete itself from the compromised computer.

MacMa has the capability to create and modify file timestamps.

MacMa has stored collected files locally before exfiltration.

MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, and macOS version.

MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.

MacMa has used a custom JSON-based protocol for its C&C communications.

MacMa has downloaded additional files, including an exploit for used privilege escalation.

MacMa has used macOS API functions to perform tasks.

MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.

MacMa has the ability to record audio.

MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.

MacMa installs a `com.apple.softwareupdate.plist` file in the `/LaunchAgents` folder with the `RunAtLoad` value set to `true`. Upon user login, MacMa is executed from `/var/root/.local/softwareupdate` with root privileges. Some variations also include the `LimitLoadToSessionType` key with the value `Aqua`, ensuring the MacMa only runs when there is a logged in GUI user.

MacMa has removed the `com.apple.quarantineattribute` from the dropped file, `$TMPDIR/airportpaird`.

MacMa has been delivered using ad hoc Apple Developer code signing certificates.

MacMa can dump credentials from the macOS keychain.

MacMa has used TCP port 5633 for C2 Communication.

MacMa has used TLS encryption to initialize a custom protocol for C2 communications.

MacMa can collect information about a compromised computer's disk sizes.

MacMa can clear possible malware traces such as application logs.