Cuckoo Stealer
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
Cuckoo Stealer can use the curl API for C2 communications.(Citation: Kandji Cuckoo April 2024) |
| Enterprise | T1059 | .002 | Command and Scripting Interpreter: AppleScript |
Cuckoo Stealer can use osascript to generate a password-stealing prompt, duplicate files and folders, and set environmental variables.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024) |
| .004 | Command and Scripting Interpreter: Unix Shell |
Cuckoo Stealer can spawn a bash shell to enable execution on compromised hosts.(Citation: Kandji Cuckoo April 2024) |
||
| Enterprise | T1543 | .001 | Create or Modify System Process: Launch Agent |
Cuckoo Stealer can achieve persistence by creating launch agents to repeatedly execute malicious payloads.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024) |
| Enterprise | T1555 | .001 | Credentials from Password Stores: Keychain |
Cuckoo Stealer can capture files from a targeted user's keychain directory.(Citation: Kandji Cuckoo April 2024) |
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
Cuckoo Stealer has staged collected application data from Safari, Notes, and Keychain to `/var/folder`.(Citation: Kandji Cuckoo April 2024) |
| Enterprise | T1564 | .001 | Hide Artifacts: Hidden Files and Directories |
Cuckoo Stealer has copied its binary and the victim's scraped password into a hidden folder in the `/Users` directory.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024) |
| Enterprise | T1056 | .002 | Input Capture: GUI Input Capture |
Cuckoo Stealer has captured passwords by prompting victims with a “macOS needs to access System Settings” GUI window.(Citation: Kandji Cuckoo April 2024) |
| Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
Cuckoo Stealer has copied and renamed itself to DumpMediaSpotifyMusicConverter.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024) |
| Enterprise | T1027 | .008 | Obfuscated Files or Information: Stripped Payloads |
Cuckoo Stealer is a stripped binary payload.(Citation: Kandji Cuckoo April 2024) (Citation: SentinelOne Cuckoo Stealer May 2024) |
| .013 | Obfuscated Files or Information: Encrypted/Encoded File |
Cuckoo Stealer strings are XOR-encrypted.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024) |
||
| Enterprise | T1553 | .001 | Subvert Trust Controls: Gatekeeper Bypass |
Cuckoo Stealer can use `xattr -d com.apple.quarantine` to remove the quarantine flag attribute.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024) |
| Enterprise | T1614 | .001 | System Location Discovery: System Language Discovery |
Cuckoo Stealer can check the systems `LANG` environmental variable to prevent infecting devices from Armenia (`hy_AM`), Belarus (`be_BY`), Kazakhstan (`kk_KZ`), Russia (`ru_RU`), and Ukraine (`uk_UA`).(Citation: Kandji Cuckoo April 2024) |
| Enterprise | T1569 | .001 | System Services: Launchctl |
Cuckoo Stealer can use `launchctl` to load a LaunchAgent for persistence.(Citation: Kandji Cuckoo April 2024) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.