MacOS_Backdoor_Applejeus_a54e423c

Description

MacOS.Backdoor.Applejeus

Query · yara

strings:
        $a = { 81 3F 28 00 00 80 74 ?? 8B 4F 04 48 01 CF FF C2 44 39 C2 }
    condition:
        all of them
Raw source MacOS_Backdoor_Applejeus_a54e423c · YARA
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
rule MacOS_Backdoor_Applejeus_a54e423c {
    meta:
        author = "Elastic Security"
        id = "a54e423c-6467-4c80-9a2a-c868d3323d77"
        fingerprint = "413318971af37b634e5022241b8b6ab85d6cf113902acacbb750a268c1c1fc22"
        creation_date = "2026-02-26"
        last_modified = "2026-04-06"
        threat_name = "MacOS.Backdoor.Applejeus"
        reference_sample = "8e2b17417cb99e7b689f46ef1c8500a33860e28e497f495c02eece2d4c3217f8"
        severity = 100
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "macos"
    strings:
        $a = { 81 3F 28 00 00 80 74 ?? 8B 4F 04 48 01 CF FF C2 44 39 C2 }
    condition:
        all of them
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.