ATT&CK SoftwareProton

Proton

S0279

Malware.View on attack.mitre.org

About this malware

Proton is a macOS backdoor focusing on data theft and credential access .

Procedure examples15

Technique	Procedure example
T1021.005 VNC	Proton uses VNC to connect into systems. objsee mac malware 2017
T1056.001 Keylogging	Proton uses a keylogger to capture keystrokes. objsee mac malware 2017
T1056.002 GUI Input Capture	Proton prompts users for their credentials. objsee mac malware 2017
T1059.004 Unix Shell	Proton uses macOS' .command file type to script actions. objsee mac malware 2017
T1070.004 File Deletion	Proton removes all files in the /tmp directory. objsee mac malware 2017
T1113 Screen Capture	Proton captures the content of the desktop with the screencapture binary. objsee mac malware 2017
T1140 Deobfuscate/Decode Files or Information	Proton uses an encrypted file to store commands and configuration values. objsee mac malware 2017
T1543.001 Launch Agent	Proton persists via Launch Agent. objsee mac malware 2017
T1548.003 Sudo and Sudo Caching	Proton modifies the tty_tickets line in the sudoers file. objsee mac malware 2017
T1555.001 Keychain	Proton gathers credentials in files for keychains. objsee mac malware 2017
T1555.003 Credentials from Web Browsers	Proton gathers credentials for Google Chrome. objsee mac malware 2017
T1555.005 Password Managers	Proton gathers credentials in files for 1password. objsee mac malware 2017
T1560 Archive Collected Data	Proton zips up files before exfiltrating them. objsee mac malware 2017
T1685 Disable or Modify Tools	Proton kills security tools like Wireshark that are running. objsee mac malware 2017
T1685.006 Clear Linux or Mac System Logs	Proton removes logs from `/var/logs` and `/Library/logs`. objsee mac malware 2017

Groups that use it0

None recorded.

Campaigns0

None recorded.

References1

objsee mac malware 2017 Open source
Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.