Threat Intelligence Directory

Malware family identifying osx.tsunami. Origin and technical characteristics tracked via Malpedia.

General purpose backdoor

Malware family identifying osx.sysjoker. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.sugarloader. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.spectral_blur. Origin and technical characteristics tracked via Malpedia.

SimpleTea is a RAT for macOS that is based on the same object-oriented project as SimpleTea for Linux (SimplexTea). It also shares similarities with POOLRAT (also known as SIMPLESEA), like the supported commands or a single-byte XOR encryption of its configuration. However, the indices of commands are different. SimpleTea for macOS was uploaded to VirusTotal from Hong Kong and China in September 2023.

According to Red Canary, Silver Sparrow is an activity cluster that includes a binary compiled to run on Apple’s new M1 chips but has been distributed without payload so far.

According to PCrisk, Shlayer is a trojan-type virus designed to proliferate various adware and other unwanted applications, and promote fake search engines. It is typically disguised as a Adobe Flash Player installer and various software cracking tools. In most cases, users encounter this virus when visiting dubious Torrent websites that are full of intrusive advertisements and deceptive downloads.

Malware family identifying osx.rustbucket. Origin and technical characteristics tracked via Malpedia.

Dok a.k.a. Retefe is the macOS version of the banking trojan Retefe. It consists of a codesigned Mach-O dropper usually malspammed in an app bundle within a DMG disk image, posing as a document. The primary purpose of the dropper is to install a Tor client as well as a malicious CA certificate and proxy pac URL, in order to redirect traffic to targeted sites through their Tor node, effectively carrying out a MITM attack against selected web traffic. It also installs a custom hosts file to prevent access to Apple and VirusTotal. The macOS version shares its MO, many TTPs and infrastructure with the Windows counterpart.

Cryptocurrency miner that was distributed masquerading as a Counter-Strike: Global Offensive hack.

According to SentinelOne, this is an infostealer, targeting among other things the encrypted database of Zoom.

Proton RAT is a Remote Access Trojan (RAT) specifically designed for macOS systems. It is known for providing attackers with complete remote control over the infected system, allowing the execution of commands, keystroke capturing, access to the camera and microphone, and the ability to steal credentials stored in browsers and other password managers. This malware typically spreads through malicious or modified applications, which, when downloaded and installed by unsuspecting users, trigger its payload. Proton RAT is notorious for its sophistication and evasion capabilities, including techniques to bypass detection by installed security solutions.

macOS infostealer sold by an individual named Rodrigo4, currently consisting of a disk image containing a Mach-O without app bundle, which when executed spawns osascript executing an AppleScript with the actual infostealer payload. The AppleScript payload will steal files by packing them in a ZIP archive and uploading them to a hardcoded C2 via HTTP.

Part of Mythic C2, written in Golang.

Malware family identifying osx.poolrat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.pirrit. Origin and technical characteristics tracked via Malpedia.

Backdoor as a fork of OpenSSH_6.0 with no logging, and “-P” and “-z” hidden command arguments. “PuffySSH_5.8p1” string.

Malware family identifying osx.pearl_stealer. Origin and technical characteristics tracked via Malpedia.

This crypto-ransomware for macOS was caught spreading via BitTorrent distribution sites in February 2017, masquerading as 'Patcher', an application used for pirating popular software like Adobe Premiere Pro or Microsoft Office for Mac. The downloaded torrent contained an application bundle in the form of a single zip file. After launching the fake application, the main window of the fake cracking tool was displayed. The file encryption process was launched after the misguided victim clicked 'Start'. Once executed, the ransomware generated a random 25-character string and set it as the key for RC4 encryption of all of the user's files. It then demanded ransom in Bitcoin, as instructed in the 'README!' .txt file copied all over the user's directories. Despite the instructions being quite thorough, Patcher lacked the functionality to communicate with any C&C server, and therefore made it impossible for its operators to decrypt affected files. The randomly generated encryption key was also too long to be guessed via a brute-force attack, leaving the encrypted data unrecoverable in a reasonable amount of time.

Malware family identifying osx.osaminer. Origin and technical characteristics tracked via Malpedia.

SentinelOne describes this as a malware written in Go, mixing own custom code with code from public repositories.

Malware family identifying osx.olyx. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.odyssey_stealer. Origin and technical characteristics tracked via Malpedia.

According to PcRisk, Research shows that the OceanLotus 'backdoor' targets MacOS computers. Cyber criminals behind this backdoor have already used this malware to attack human rights and media organizations, some research institutes, and maritime construction companies. The OceanLotus backdoor is distributed via a fake Adobe Flash Player installer and a malicious Word document (it is likely that threat authors distribute the document via malspam emails).

Malware family identifying osx.netwire. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.mughthesec. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.mokes. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.manuscrypt. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.mami. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.macvx. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.macspy. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.macransom. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.macinstaller. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.macdownloader. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.lockbit. Origin and technical characteristics tracked via Malpedia.

According to Volexity, LIGHTSPY is a multi-platform malware family with documented variants for Android, iOS, and macOS.

Malware family identifying osx.leverage. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.laoshu. Origin and technical characteristics tracked via Malpedia.

Malware family identifying osx.lambert. Origin and technical characteristics tracked via Malpedia.