H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

CoinTicker

[CoinTicker](https://attack.mitre.org/software/S0369) is a malicious application that poses as a cryptocurrency price ticker and installs components of the open source backdoors EvilOSX and EggShell.(Citation: CoinTicker 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[CoinTicker](https://attack.mitre.org/software/S0369) is a malicious application that poses as a cryptocurrency price ticker and installs components of the open source backdoors EvilOSX and EggShell.(Citation: CoinTicker 2019)

Labels

malware
9 recorded

Relationships

uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Gatekeeper Bypass
Technique
uses
to Hidden Files and Directories
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Launch Agent
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Python
Technique
uses
to Unix Shell
Technique
uses
to Windows Command Shell
Technique
2 external

References

mitre-attack
S0369
open
CoinTicker 2019
https://blog.malwarebytes.com/threat-analysis/2018/10/mac-cryptocurrency-ticker-app-installs-backdoors/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance