Thomas. (2013, July 15). New signed malware called Janicab. Retrieved July 17, 2017.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1053.003 Cron |
MalwareJanicab | Janicab used a cron job for persistence on Mac devices. |
| T1113 Screen Capture |
MalwareJanicab | Janicab captured screenshots and sent them out to a C2 server. |
| T1123 Audio Capture |
MalwareJanicab | Janicab captured audio and sent it out to a C2 server. |
| T1553.002 Code Signing |
MalwareJanicab | Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
