Procedure examples

AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.

AppleJeus has exfiltrated collected host information to a C2 server.

AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.

AppleJeus has deleted the MSI file after installation.

AppleJeus has sent data to its C2 server via POST requests.

AppleJeus has collected the victim host information after infection.

AppleJeus has decoded files received from a C2.

AppleJeus's spearphishing links required user interaction to navigate to the malicious website.

AppleJeus has required user execution of a malicious MSI installer.

AppleJeus has been installed via MSI installer.

AppleJeus has waited a specified time before downloading a second stage payload.

AppleJeus can install itself as a service.

AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.

During AppleJeus's installation process, it uses `postinstall` scripts to extract a hidden plist from the application's `/Resources` folder and execute the `plist` file as a Launch Daemon with elevated permissions.

AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.

AppleJeus has used a valid digital signature from Sectigo to appear legitimate.

AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings.

AppleJeus has been distributed via spearphishing link.

AppleJeus has loaded a plist file using the launchctl command.