The backdoor changes the permission of the file it wants to execute to +x  T1027  Obfuscated Files or Information  Readable strings were encrypted  T1036.005  Masquerading: Match Legitimate Name or Location  The app bundle is disguised as a doc file to trick users into executing it  T1070.006  Indicator Removal