Search/MacMa
● Malware

MacMa

MacMa is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. MacMa has been observed in the wild since November 2021. MacMa shares command and control and unique libraries with MgBot and Nightdoor, indicating a relationship with the Daggerfly threat actor.

View graph Watch Export
Indicators tracked
0
Intelligence Reports30
30 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
30 relationships
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1056.001: Keylogging
source
T1123: Audio Capture
source
T1074.001: Local Data Staging
source
T1555.001: Keychain
source
T1553.001: Gatekeeper Bypass
source
T1553.002: Code Signing
source
T1082: System Information Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1070.006: Timestomp
source
T1021: Remote Services
source
T1685.006: Clear Linux or Mac System Logs
source
T1016: System Network Configuration Discovery
source
T1083: File and Directory Discovery
source
T1057: Process Discovery
source
T1041: Exfiltration Over C2 Channel
source
T1059.004: Unix Shell
source
T1571: Non-Standard Port
source
T1573: Encrypted Channel
source
T1095: Non-Application Layer Protocol
source
T1543.001: Launch Agent
source
T1070.004: File Deletion
source
T1105: Ingress Tool Transfer
source
T1680: Local Storage Discovery
source