MITRE ATT&CKsoftware (malware)

S0352 OSX_OCEANLOTUS.D

Published 2019-01-30 Modified 2024-04-11 Official page ↗
Domain
enterprise
Platforms
macOS
Aliases
Backdoor.MacOS.OCEANLOTUS.F
Version
3.1
Created
2019-01-30

Description

OSX_OCEANLOTUS.D is a macOS backdoor used by APT32. First discovered in 2015, APT32 has continued to make improvements using a plugin architecture to extend capabilities, specifically using `.dylib` files. OSX_OCEANLOTUS.D can also determine it's permission level and execute according to access type (`root` or `user`).

Related

Uses · MITRE ATT&CK (28)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1036.008 Masquerade File Type sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1571 Non-Standard Port technique
  • T1059.001 PowerShell sub-technique
  • T1059.004 Unix Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1497.001 System Checks sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1560.002 Archive via Library sub-technique
  • T1560.003 Archive via Custom Method sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1027.002 Software Packing sub-technique
  • T1553.001 Gatekeeper Bypass sub-technique
  • T1222.002 Linux and Mac Permissions sub-technique
  • T1070.004 File Deletion sub-technique
  • T1070.006 Timestomp sub-technique
  • T1543.001 Launch Agent sub-technique
  • T1543.004 Launch Daemon sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1016 System Network Configuration Discovery technique
  • T1082 System Information Discovery technique
  • T1095 Non-Application Layer Protocol technique
  • T1105 Ingress Tool Transfer technique
  • T1129 Shared Modules technique

Referenced by MITRE ATT&CK · uses (1)

References