CoinTicker — Malware Profile

CoinTicker is a malicious application that poses as a cryptocurrency price ticker and installs components of the open source backdoors EvilOSX and EggShell.

MITRE ATT&CK techniques (9)

• T1027 Obfuscated Files or Information
• T1059.003 Windows Command Shell
• T1059.004 Unix Shell
• T1059.006 Python
• T1105 Ingress Tool Transfer
• T1140 Deobfuscate/Decode Files or Information
• T1543.001 Launch Agent
• T1553.001 Gatekeeper Bypass
• T1564.001 Hidden Files and Directories

Read the full analysis on IntelFusions