value:  CookieMiner has used a Unix shell script to run a series of commands targeting macOS. ;; Derusbi is capable of creating a remote Bash shell and executing commands. ;; Doki has executed shell scripts with /bin/sh. ;; Drovorub can execute arbitrary commands as root on a compromised system. ;; Exaramel for Linux has a command to execute a shell command on the system. ;; Fysbis has the ability to create and execute commands in a remote shell for CLI. ;; Hildegard has used shell scripts for execution. ;; Kazuar uses /bin/bash to execute commands on the victim’s machine. ;; Kinsing has used Unix shell scripts to execute commands in the victim environment. ;; LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization. ;; NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands. ;; OSX/Shlayer can use bash scripts to check the macOS version and download payloads. ;; OSX_OCEANLOTUS.D can use shell script to execute malicious code. ;; Penquin can execute remote commands using bash scripts. ;; Proton uses macOS' .command file type to script actions. ;; Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware. ;; Skidmap has used pm.sh to download and install its main payload. ;; WindTail can use the open command to execute an application.
name: Command and Scripting Interpreter: Unix Shell