ATT&CK SoftwareiKitten

iKitten

S0278

Malware.View on attack.mitre.org

About this malware

iKitten is a macOS exfiltration agent .

Techniques used7

Persistence1

T1037.004RC Scripts

Privilege Escalation1

T1037.004RC Scripts

Stealth1

T1564.001Hidden Files and Directories

Credential Access2

T1056.002GUI Input Capture T1555.001Keychain

Discovery2

T1016System Network Configuration Discovery T1057Process Discovery

Collection2

T1056.002GUI Input Capture T1560.001Archive via Utility

Procedure examples7

Technique	Procedure example
T1016 System Network Configuration Discovery	iKitten will look for the current IP address. objsee mac malware 2017
T1037.004 RC Scripts	iKitten adds an entry to the rc.common file for persistence. objsee mac malware 2017
T1056.002 GUI Input Capture	iKitten prompts the user for their credentials. objsee mac malware 2017
T1057 Process Discovery	iKitten lists the current processes running. objsee mac malware 2017
T1555.001 Keychain	iKitten collects the keychains on the system. objsee mac malware 2017
T1560.001 Archive via Utility	iKitten will zip up the /Library/Keychains directory before exfiltrating it. objsee mac malware 2017
T1564.001 Hidden Files and Directories	iKitten saves itself with a leading "." so that it's hidden from users by default. objsee mac malware 2017

Groups that use it0

None recorded.

Campaigns0

None recorded.

References1

objsee mac malware 2017 Open source
Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.