S1048 macOS.OSAMiner

malwareEnterprise

platformsmacOS

also known asmacOS.OSAMiner

macOS.OSAMiner is a Monero mining trojan that was first observed in 2018; security researchers assessed macOS.OSAMiner may have been circulating since at least 2015. macOS.OSAMiner is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.

techniques used (11)

ATT&CK techniques this enables or maps to.

T1027.008Stripped Payloads
T1027.009Embedded Payloads
T1057Process Discovery
T1059.002AppleScript
T1082System Information Discovery
T1105Ingress Tool Transfer
T1497.001System Checks
T1543.001Launch Agent
T1569.001Launchctl
T1680Local Storage Discovery
T1685Disable or Modify Tools

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan