SOFTWARE
SOFTWARE
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
Keydnap
This piece of malware steals the content of the user's keychain while maintaining a permanent backdoor [1].
ID: S0276
Associated Software: OSX/Keydnap
Type: MALWARE
Platforms: macOS
Version: 1.1
Created: 17 October 2018
Last Modified: 30 March 2020
Associated Software Descriptions
Name | Description |
---|---|
OSX/Keydnap |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1548 | .001 | Abuse Elevation Control Mechanism: Setuid and Setgid |
Keydnap adds the setuid flag to a binary so it can easily elevate in the future.[1] |
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1059 | .006 | Command and Scripting Interpreter: Python |
Keydnap uses Python for scripting to execute additional commands.[2] |
Enterprise | T1543 | .001 | Create or Modify System Process: Launch Agent | |
Enterprise | T1555 | .002 | Credentials from Password Stores: Securityd Memory |
Keydnap uses the keychaindump project to read securityd memory.[2] |
Enterprise | T1056 | .002 | Input Capture: GUI Input Capture | |
Enterprise | T1036 | .006 | Masquerading: Space after Filename |
Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.[2] |
Enterprise | T1090 | .003 | Proxy: Multi-hop Proxy |
Keydnap uses a copy of tor2web proxy for HTTPS communications.[2] |
References
×