HackingTeam Reborn; A Brief Analyis of the RCS Implant Installer
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Patrick Wardle's analysis of a HackingTeam RCS implant installer, published on his Objective-See blog, shows how the dropper used Apple's native binary encryption to conceal its code, evaded detection by all 54 AV engines on VirusTotal, and installed a persistent implant via a user Launch Agent.