MITRE ATT&CKsoftware (malware)
S0281 Dok
- Domain
- enterprise
- Platforms
- macOS
- Aliases
- Retefe
- Version
- 2.0
- Created
- 2018-10-17
Description
Dok is a Trojan application disguised as a .zip file that is able to collect user credentials and install a malicious proxy server to redirect a user's network traffic (i.e. Adversary-in-the-Middle).
Related
Uses · MITRE ATT&CK (11)
- T1547.015 Login Items sub-technique
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1059.002 AppleScript sub-technique
- T1553.004 Install Root Certificate sub-technique
- T1056.002 GUI Input Capture sub-technique
- T1557 Adversary-in-the-Middle technique
- T1027.002 Software Packing sub-technique
- T1222.002 Linux and Mac Permissions sub-technique
- T1548.003 Sudo and Sudo Caching sub-technique
- T1543.001 Launch Agent sub-technique
References
- https://web.archive.org/web/20221007144948/http://www.hexed.in/2019/07/osxdok-analysis.html hexed osx.dok analysis 2019
- https://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/ CheckPoint Dok
- https://objective-see.com/blog/blog_0x25.html objsee mac malware 2017