ATT&CK SoftwareMacSpy

MacSpy

S0282

Malware.View on attack.mitre.org

About this malware

MacSpy is a malware-as-a-service offered on the darkweb .

Techniques used9

Persistence1

T1543.001Launch Agent

Privilege Escalation1

T1543.001Launch Agent

Stealth2

T1070.004File Deletion T1564.001Hidden Files and Directories

Credential Access1

T1056.001Keylogging

Collection4

T1056.001Keylogging T1113Screen Capture T1115Clipboard Data T1123Audio Capture

Command and Control2

T1071.001Web Protocols T1090.003Multi-hop Proxy

Procedure examples9

Technique	Procedure example
T1056.001 Keylogging	MacSpy captures keystrokes. objsee mac malware 2017
T1070.004 File Deletion	MacSpy deletes any temporary files it creates alientvault macspy
T1071.001 Web Protocols	MacSpy uses HTTP for command and control. objsee mac malware 2017
T1090.003 Multi-hop Proxy	MacSpy uses Tor for command and control. objsee mac malware 2017
T1113 Screen Capture	MacSpy can capture screenshots of the desktop over multiple monitors. objsee mac malware 2017
T1115 Clipboard Data	MacSpy can steal clipboard contents. objsee mac malware 2017
T1123 Audio Capture	MacSpy can record the sounds from microphones on a computer. objsee mac malware 2017
T1543.001 Launch Agent	MacSpy persists via a Launch Agent. objsee mac malware 2017
T1564.001 Hidden Files and Directories	MacSpy stores itself in `~/Library/.DS_Stores/` alientvault macspy

Groups that use it0

None recorded.

Campaigns0

None recorded.

References1

objsee mac malware 2017 Open source
Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.