MITRE ATT&CKsoftware (malware)
S1048 macOS.OSAMiner
- Domain
- enterprise
- Platforms
- macOS
- Version
- 1.1
- Created
- 2022-10-04
Description
macOS.OSAMiner is a Monero mining trojan that was first observed in 2018; security researchers assessed macOS.OSAMiner may have been circulating since at least 2015. macOS.OSAMiner is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.
Related
Uses · MITRE ATT&CK (11)
- T1685 Disable or Modify Tools technique
- T1680 Local Storage Discovery technique
- T1027.009 Embedded Payloads sub-technique
- T1027.008 Stripped Payloads sub-technique
- T1569.001 Launchctl sub-technique
- T1059.002 AppleScript sub-technique
- T1497.001 System Checks sub-technique
- T1543.001 Launch Agent sub-technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
References
- https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/ SentinelLabs reversing run-only applescripts 2021
- https://www.vmray.com/cyber-security-blog/osaminer-uses-applescripts-evade-detection-malware-analysis-spotlight/ VMRay OSAMiner dynamic analysis 2021