ATT&CK SoftwareKomplex

Komplex

S0162

Malware.View on attack.mitre.org

About this malware

Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX .

Techniques used7

Persistence1

T1543.001Launch Agent

Privilege Escalation1

T1543.001Launch Agent

Stealth2

T1070.004File Deletion T1564.001Hidden Files and Directories

Discovery2

T1033System Owner/User Discovery T1057Process Discovery

Command and Control2

T1071.001Web Protocols T1573.001Symmetric Cryptography

Procedure examples7

Technique	Procedure example
T1033 System Owner/User Discovery	The OsInfo function in Komplex collects the current running username. Sofacy Komplex Trojan
T1057 Process Discovery	The OsInfo function in Komplex collects a running process list. Sofacy Komplex Trojan
T1070.004 File Deletion	The Komplex trojan supports file deletion. Sofacy Komplex Trojan
T1071.001 Web Protocols	The Komplex C2 channel uses HTTP POST requests. Sofacy Komplex Trojan
T1543.001 Launch Agent	The Komplex trojan creates a persistent launch agent called with `$HOME/Library/LaunchAgents/com.apple.updates.plist` with `launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist`. Sofacy Komplex Trojan
T1564.001 Hidden Files and Directories	The Komplex payload is stored in a hidden directory at `/Users/Shared/.local/kextd`. Sofacy Komplex Trojan
T1573.001 Symmetric Cryptography	The Komplex C2 channel uses an 11-byte XOR algorithm to hide data. Sofacy Komplex Trojan

Groups that use it1

Campaigns0

None recorded.

References2

Sofacy Komplex Trojan Open source
Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
XAgentOSX 2017 Open source
Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.