value:  FruitFly persists via a Launch Agent. ;; Keydnap uses a Launch Agent to persist. ;; The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist. ;; MacSpy persists via a Launch Agent. ;; NETWIRE can use launch agents for persistence. ;; OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents. ;; Proton persists via Launch Agent. ;; ThiefQuest installs a launch item using an embedded encrypted launch agent property list template. The plist file is installed in the ~/Library/LaunchAgents/ folder and configured with the path to the persistent binary located in the ~/Library/ folder.
name: Create or Modify System Process: Launch Agent