Effy Elden
@ineffyble3 followers309 downloads101 copies6 likes2,540 views
27 detections
Filters
Last updated
All Time
Detection languages
21
4
2
Categories
12
3
3
3
3
Platforms
19
4
3
2
1
Products / Services
2
1
1
1
MITRE Techniques
14
9
6
6
5
CVEs
1
Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.
Detects curl downloading a file, making it executable with chmod, and executing it in the background, common in FlexibleFerret malware delivery on macOS systems.
Detects the execution of shell scripts and creation of files associated with the FlexibleFerret macOS malware campaign, which is tied to fake job recruitment lures to trick users into executing malicious commands.
Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.
Detects access to Chrome profile data and Login Data database associated with credential theft activities linked to FlexibleFerret malware on macOS.
Detects creation of FlexibleFerret persistence mechanism via LaunchAgent plist in macOS.
Detects extraction of FlexibleFerret malware payload archive to the CDrivers directory on macOS systems.
Detects Go runtime executing scripts from temporary directories, indicative of FlexibleFerret backdoor.
Detects execution of ad-hoc signed applications from suspicious locations, used by FlexibleFerret credential harvesting.
Detects creation of .host file in temp directories by FlexibleFerret malware for identifying machines on macOS systems.
Page 2 of 3