XAgentOSX 2017

XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.

XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.

XAgentOSX contains the getProcessList function to run ps aux to get running processes.

XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.

XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.

XAgentOSX contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed.

XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\ Support/MobileSync/Backup/.

XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.

XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.

APT28 has used tools to take screenshots from victims.

XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.