17 lines
594 B
Text
17 lines
594 B
Text
|
rule malware_macos_marten4n6_evilosx
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "EvilOSX is a pure python, post-exploitation, RAT (Remote Administration Tool) for macOS / OSX."
|
||
|
|
reference = "https://github.com/Marten4n6/EvilOSX"
|
||
|
|
author = "@mimeframe"
|
||
|
|
strings:
|
||
|
|
// EvilOSX.py commands
|
||
|
|
$a1 = "icloud_phish_stop" fullword wide ascii
|
||
|
|
$a2 = "icloud_contacts" fullword wide ascii
|
||
|
|
$a3 = "itunes_backups" fullword wide ascii
|
||
|
|
$a4 = "chrome_passwords" fullword wide ascii
|
||
|
|
$a5 = "Starting EvilOSX..." wide ascii
|
||
|
|
condition:
|
||
|
|
4 of ($a*)
|
||
|
|
}
|