FruitFly OSX Malware (https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/): Artifacts created by this malware
Query:
select * from launchd where name = 'com.client.client.plist';Additional Query Info:
Version: 1.4.5
Platform: darwin
Interval: 3600
JSON:
{ "queries": { "OSX_FruitFly": { "query" : "select * from launchd where name = 'com.client.client.plist';", "interval" : "3600", "platform" : "darwin", "version": "1.4.5", "description" : "FruitFly OSX Malware (https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/)", "value" : "Artifacts created by this malware" } } }