Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

HiddedLotus.dmg

macos_amd64

10

Resubmissions

04/06/2021, 11:41

210604-62q4dlr18s 10

04/06/2021, 11:25

210604-5xq6ap77we 10

03/06/2021, 17:10

210603-wqhytdhkea 10

03/06/2021, 16:16

210603-lf7tyvce86 10

Analysis

  • max time kernel
    142s
  • max time network
    120s
  • platform
    macos_amd64
  • resource
    macos
  • submitted
    03/06/2021, 16:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HiddedLotus.dmg

  • Size

    548KB

  • MD5

    54f7eadddcae17f1cb10d0cdaf426408

  • SHA1

    bda404cb5709a1f026c47a1c0508b2b753a47836

  • SHA256

    7769af718266fcc91c9f39eb71d1b137156b95d6e6704d9b783988e3421ac656

  • SHA512

    a1baa3532e2237a73e8ccc353b1e1de936ec49e2a3b995ae030092873f4f5bb74d7be47eb75e85a3da254f3d21c147e2327fa67b728e70ebe09d297ccc188179

Score
10/10
hiddenlotusminer

Malware Config

Signatures

Processes

  • /usr/bin/hdiutil
    hdiutil attach /Users/run/HiddedLotus.dmg -shadow
    1⤵
      PID:455
    • /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
      /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid F5111F53-DA80-4A19-A430-0EE6B2D7606C
      1⤵
        PID:457
      • /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid F5111F53-DA80-4A19-A430-0EE6B2D7606C -post-exec 4
        1⤵
          PID:458
        • /usr/bin/hdiutil
          hdiutil info -plist
          1⤵
            PID:466
          • /bin/chmod
            chmod -R 755 /Volumes/HiddedLotus
            1⤵
              PID:467
            • /usr/sbin/sysctl
              sysctl -w "kern.bigmacbundlepath=/Volumes/HiddedLotus/HiddedLotus.app"
              1⤵
                PID:468
              • /bin/sh
                sh -c /tmp/exec
                1⤵
                  PID:469
                • /bin/bash
                  sh -c /tmp/exec
                  1⤵
                    PID:469
                  • /tmp/exec
                    /tmp/exec
                    1⤵
                      PID:469
                    • /bin/bash
                      /bin/sh /tmp/exec
                      1⤵
                        PID:469
                        • /bin/rm
                          rm -- /tmp/exec
                          2⤵
                            PID:472
                          • /usr/bin/sudo
                            sudo -k -S open /Volumes/HiddedLotus/HiddedLotus.app
                            2⤵
                              PID:471
                              • /usr/bin/open
                                open /Volumes/HiddedLotus/HiddedLotus.app
                                3⤵
                                  PID:473
                            • /Volumes/HiddedLotus/HiddedLotus.app/Contents/MacOS/Lê Thu Hà (HAEDC)
                              "/Volumes/HiddedLotus/HiddedLotus.app/Contents/MacOS/Lê Thu Hà (HAEDC)"
                              1⤵
                                PID:474
                              • /bin/sh
                                sh -c "osascript -e 'tell application \"Finder\"' -e 'set visible of process \"Terminal\" to false' -e 'end tell' > /dev/null 2>&1"
                                1⤵
                                  PID:476
                                • /bin/bash
                                  sh -c "osascript -e 'tell application \"Finder\"' -e 'set visible of process \"Terminal\" to false' -e 'end tell' > /dev/null 2>&1"
                                  1⤵
                                    PID:476
                                    • /usr/bin/osascript
                                      osascript -e "tell application \"Finder\"" -e "set visible of process \"Terminal\" to false" -e "end tell"
                                      2⤵
                                        PID:477
                                    • /bin/sh
                                      sh -c "touch -t 1311232025 \"/Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd\" >/dev/null 2>&1"
                                      1⤵
                                        PID:480
                                      • /bin/bash
                                        sh -c "touch -t 1311232025 \"/Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd\" >/dev/null 2>&1"
                                        1⤵
                                          PID:480
                                          • /usr/bin/touch
                                            touch -t 1311232025 /Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd
                                            2⤵
                                              PID:481
                                          • /bin/sh
                                            sh -c "touch -t 1311232025 \"/Users/run/Library/LaunchAgents/com.apple.hidd.shared.plist\" >/dev/null 2>&1"
                                            1⤵
                                              PID:482
                                            • /bin/bash
                                              sh -c "touch -t 1311232025 \"/Users/run/Library/LaunchAgents/com.apple.hidd.shared.plist\" >/dev/null 2>&1"
                                              1⤵
                                                PID:482
                                                • /usr/bin/touch
                                                  touch -t 1311232025 /Users/run/Library/LaunchAgents/com.apple.hidd.shared.plist
                                                  2⤵
                                                    PID:483
                                                • /bin/sh
                                                  sh -c "launchctl load ~/Library/LaunchAgents/com.apple.hidd.shared.plist > /dev/null 2>&1 &"
                                                  1⤵
                                                    PID:484
                                                  • /bin/sh
                                                    sh -c "mv -f \"/Volumes/HiddedLotus/HiddedLotus.app/Contents/Resources/configureDefault.sys\" \"/tmp/HiddedLotus.pdf\" > /dev/null 2>&1 ; open \"/tmp/HiddedLotus.pdf\" & > /dev/null 2>&1 ; rm -rf \"/Volumes/HiddedLotus/HiddedLotus.app\" > /dev/null 2>&1 ; cp -f \"/tmp/HiddedLotus.pdf\" \"/Volumes/HiddedLotus/HiddedLotus.pdf\" > /dev/null 2>&1 ; sleep 3 ; rm -rf \"/tmp/HiddedLotus.pdf\" > /dev/null 2>&1"
                                                    1⤵
                                                      PID:485
                                                    • /bin/bash
                                                      sh -c "launchctl load ~/Library/LaunchAgents/com.apple.hidd.shared.plist > /dev/null 2>&1 &"
                                                      1⤵
                                                        PID:484
                                                        • /bin/launchctl
                                                          launchctl load /Users/run/Library/LaunchAgents/com.apple.hidd.shared.plist
                                                          2⤵
                                                            PID:486
                                                        • /bin/bash
                                                          sh -c "mv -f \"/Volumes/HiddedLotus/HiddedLotus.app/Contents/Resources/configureDefault.sys\" \"/tmp/HiddedLotus.pdf\" > /dev/null 2>&1 ; open \"/tmp/HiddedLotus.pdf\" & > /dev/null 2>&1 ; rm -rf \"/Volumes/HiddedLotus/HiddedLotus.app\" > /dev/null 2>&1 ; cp -f \"/tmp/HiddedLotus.pdf\" \"/Volumes/HiddedLotus/HiddedLotus.pdf\" > /dev/null 2>&1 ; sleep 3 ; rm -rf \"/tmp/HiddedLotus.pdf\" > /dev/null 2>&1"
                                                          1⤵
                                                            PID:485
                                                            • /bin/mv
                                                              mv -f /Volumes/HiddedLotus/HiddedLotus.app/Contents/Resources/configureDefault.sys /tmp/HiddedLotus.pdf
                                                              2⤵
                                                                PID:487
                                                              • /usr/bin/open
                                                                open /tmp/HiddedLotus.pdf
                                                                2⤵
                                                                  PID:498
                                                                • /bin/rm
                                                                  rm -rf /Volumes/HiddedLotus/HiddedLotus.app
                                                                  2⤵
                                                                    PID:499
                                                                  • /bin/cp
                                                                    cp -f /tmp/HiddedLotus.pdf /Volumes/HiddedLotus/HiddedLotus.pdf
                                                                    2⤵
                                                                      PID:500
                                                                    • /bin/sleep
                                                                      sleep 3
                                                                      2⤵
                                                                        PID:502
                                                                      • /bin/rm
                                                                        rm -rf /tmp/HiddedLotus.pdf
                                                                        2⤵
                                                                          PID:506
                                                                      • /usr/libexec/xpcproxy
                                                                        xpcproxy com.apple.hidd.shared
                                                                        1⤵
                                                                          PID:488
                                                                        • /Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd
                                                                          /Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd
                                                                          1⤵
                                                                            PID:488
                                                                          • /bin/sh
                                                                            sh -c "ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split(\$0, line, \"\\\"\"); printf(\"%s\", line[4]); }' 2>&1"
                                                                            1⤵
                                                                              PID:489
                                                                            • /bin/bash
                                                                              sh -c "ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split(\$0, line, \"\\\"\"); printf(\"%s\", line[4]); }' 2>&1"
                                                                              1⤵
                                                                                PID:489
                                                                                • /usr/sbin/ioreg
                                                                                  ioreg -rd1 -c IOPlatformExpertDevice
                                                                                  2⤵
                                                                                    PID:490
                                                                                  • /usr/bin/awk
                                                                                    awk "/IOPlatformSerialNumber/ { split(\$0, line, \"\\\"\"); printf(\"%s\", line[4]); }"
                                                                                    2⤵
                                                                                      PID:491
                                                                                  • /bin/sh
                                                                                    sh -c "touch -t 1502171535 \"/Users/run/Library/Calendars/Calendar Sync Changes/Calendar Sync\" >/dev/null 2>&1"
                                                                                    1⤵
                                                                                      PID:492
                                                                                    • /bin/bash
                                                                                      sh -c "touch -t 1502171535 \"/Users/run/Library/Calendars/Calendar Sync Changes/Calendar Sync\" >/dev/null 2>&1"
                                                                                      1⤵
                                                                                        PID:492
                                                                                        • /usr/bin/touch
                                                                                          touch -t 1502171535 "/Users/run/Library/Calendars/Calendar Sync Changes/Calendar Sync"
                                                                                          2⤵
                                                                                            PID:493
                                                                                        • /bin/sh
                                                                                          sh -c "sw_vers -productVersion 2>&1"
                                                                                          1⤵
                                                                                            PID:494
                                                                                          • /bin/bash
                                                                                            sh -c "sw_vers -productVersion 2>&1"
                                                                                            1⤵
                                                                                              PID:494
                                                                                              • /usr/bin/sw_vers
                                                                                                sw_vers -productVersion
                                                                                                2⤵
                                                                                                  PID:495
                                                                                              • /bin/sh
                                                                                                sh -c "uname -m 2>&1"
                                                                                                1⤵
                                                                                                  PID:496
                                                                                                • /bin/bash
                                                                                                  sh -c "uname -m 2>&1"
                                                                                                  1⤵
                                                                                                    PID:496
                                                                                                    • /usr/bin/uname
                                                                                                      uname -m
                                                                                                      2⤵
                                                                                                        PID:497
                                                                                                    • /bin/sh
                                                                                                      sh -c "sw_vers -productVersion 2>&1"
                                                                                                      1⤵
                                                                                                        PID:507
                                                                                                      • /bin/bash
                                                                                                        sh -c "sw_vers -productVersion 2>&1"
                                                                                                        1⤵
                                                                                                          PID:507
                                                                                                          • /usr/bin/sw_vers
                                                                                                            sw_vers -productVersion
                                                                                                            2⤵
                                                                                                              PID:508
                                                                                                          • /bin/sh
                                                                                                            sh -c "uname -m 2>&1"
                                                                                                            1⤵
                                                                                                              PID:509
                                                                                                            • /bin/bash
                                                                                                              sh -c "uname -m 2>&1"
                                                                                                              1⤵
                                                                                                                PID:509
                                                                                                                • /usr/bin/uname
                                                                                                                  uname -m
                                                                                                                  2⤵
                                                                                                                    PID:510
                                                                                                                • /bin/sh
                                                                                                                  sh -c "sw_vers -productVersion 2>&1"
                                                                                                                  1⤵
                                                                                                                    PID:514
                                                                                                                  • /bin/bash
                                                                                                                    sh -c "sw_vers -productVersion 2>&1"
                                                                                                                    1⤵
                                                                                                                      PID:514
                                                                                                                      • /usr/bin/sw_vers
                                                                                                                        sw_vers -productVersion
                                                                                                                        2⤵
                                                                                                                          PID:515
                                                                                                                      • /bin/sh
                                                                                                                        sh -c "uname -m 2>&1"
                                                                                                                        1⤵
                                                                                                                          PID:516
                                                                                                                        • /bin/bash
                                                                                                                          sh -c "uname -m 2>&1"
                                                                                                                          1⤵
                                                                                                                            PID:516
                                                                                                                            • /usr/bin/uname
                                                                                                                              uname -m
                                                                                                                              2⤵
                                                                                                                                PID:517
                                                                                                                            • /bin/sh
                                                                                                                              sh -c "sw_vers -productVersion 2>&1"
                                                                                                                              1⤵
                                                                                                                                PID:519
                                                                                                                              • /bin/bash
                                                                                                                                sh -c "sw_vers -productVersion 2>&1"
                                                                                                                                1⤵
                                                                                                                                  PID:519
                                                                                                                                  • /usr/bin/sw_vers
                                                                                                                                    sw_vers -productVersion
                                                                                                                                    2⤵
                                                                                                                                      PID:520
                                                                                                                                  • /bin/sh
                                                                                                                                    sh -c "uname -m 2>&1"
                                                                                                                                    1⤵
                                                                                                                                      PID:521
                                                                                                                                    • /bin/bash
                                                                                                                                      sh -c "uname -m 2>&1"
                                                                                                                                      1⤵
                                                                                                                                        PID:521
                                                                                                                                        • /usr/bin/uname
                                                                                                                                          uname -m
                                                                                                                                          2⤵
                                                                                                                                            PID:522
                                                                                                                                        • /bin/sh
                                                                                                                                          sh -c "sw_vers -productVersion 2>&1"
                                                                                                                                          1⤵
                                                                                                                                            PID:526
                                                                                                                                          • /bin/bash
                                                                                                                                            sh -c "sw_vers -productVersion 2>&1"
                                                                                                                                            1⤵
                                                                                                                                              PID:526
                                                                                                                                              • /usr/bin/sw_vers
                                                                                                                                                sw_vers -productVersion
                                                                                                                                                2⤵
                                                                                                                                                  PID:527
                                                                                                                                              • /bin/sh
                                                                                                                                                sh -c "uname -m 2>&1"
                                                                                                                                                1⤵
                                                                                                                                                  PID:528
                                                                                                                                                • /bin/bash
                                                                                                                                                  sh -c "uname -m 2>&1"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:528
                                                                                                                                                    • /usr/bin/uname
                                                                                                                                                      uname -m
                                                                                                                                                      2⤵
                                                                                                                                                        PID:529
                                                                                                                                                    • /bin/sh
                                                                                                                                                      sh -c "sw_vers -productVersion 2>&1"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:531
                                                                                                                                                      • /bin/bash
                                                                                                                                                        sh -c "sw_vers -productVersion 2>&1"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:531
                                                                                                                                                          • /usr/bin/sw_vers
                                                                                                                                                            sw_vers -productVersion
                                                                                                                                                            2⤵
                                                                                                                                                              PID:532
                                                                                                                                                          • /bin/sh
                                                                                                                                                            sh -c "uname -m 2>&1"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:533
                                                                                                                                                            • /bin/bash
                                                                                                                                                              sh -c "uname -m 2>&1"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:533
                                                                                                                                                                • /usr/bin/uname
                                                                                                                                                                  uname -m
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:534
                                                                                                                                                                • /bin/sh
                                                                                                                                                                  sh -c "sw_vers -productVersion 2>&1"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:543
                                                                                                                                                                  • /bin/bash
                                                                                                                                                                    sh -c "sw_vers -productVersion 2>&1"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:543
                                                                                                                                                                      • /usr/bin/sw_vers
                                                                                                                                                                        sw_vers -productVersion
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:544
                                                                                                                                                                      • /bin/sh
                                                                                                                                                                        sh -c "uname -m 2>&1"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:545
                                                                                                                                                                        • /bin/bash
                                                                                                                                                                          sh -c "uname -m 2>&1"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:545
                                                                                                                                                                            • /usr/bin/uname
                                                                                                                                                                              uname -m
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:546
                                                                                                                                                                            • /bin/sh
                                                                                                                                                                              sh -c "sw_vers -productVersion 2>&1"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:548
                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                sh -c "sw_vers -productVersion 2>&1"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:548
                                                                                                                                                                                  • /usr/bin/sw_vers
                                                                                                                                                                                    sw_vers -productVersion
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:549
                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                    sh -c "uname -m 2>&1"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:550
                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                      sh -c "uname -m 2>&1"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:550
                                                                                                                                                                                        • /usr/bin/uname
                                                                                                                                                                                          uname -m
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:551

                                                                                                                                                                                        Network

                                                                                                                                                                                        MITRE ATT&CK Matrix

                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                        Downloads