ATT&CK SoftwareFruitFly

FruitFly

S0277

Malware.View on attack.mitre.org

About this malware

FruitFly is designed to spy on mac users .

Techniques used7

Persistence1

T1543.001Launch Agent

Privilege Escalation1

T1543.001Launch Agent

Stealth3

T1027.010Command Obfuscation T1070.004File Deletion T1564.001Hidden Files and Directories

Discovery2

T1057Process Discovery T1083File and Directory Discovery

Collection1

T1113Screen Capture

Procedure examples7

Technique	Procedure example
T1027.010 Command Obfuscation	FruitFly executes and stores obfuscated Perl scripts. objsee mac malware 2017
T1057 Process Discovery	FruitFly has the ability to list processes on the system. objsee mac malware 2017
T1070.004 File Deletion	FruitFly will delete files on the system. objsee mac malware 2017
T1083 File and Directory Discovery	FruitFly looks for specific files and file types. objsee mac malware 2017
T1113 Screen Capture	FruitFly takes screenshots of the user's desktop. objsee mac malware 2017
T1543.001 Launch Agent	FruitFly persists via a Launch Agent. objsee mac malware 2017
T1564.001 Hidden Files and Directories	FruitFly saves itself with a leading "." to make it a hidden file. objsee mac malware 2017

Groups that use it0

None recorded.

Campaigns0

None recorded.

References1

objsee mac malware 2017 Open source
Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.