hiddenlotus | 7769af718266fcc91c9f39eb71d1b137156b95d6e6704d9b783988e3421ac656

General

Target

HiddedLotus.dmg
Size

548KB
MD5

54f7eadddcae17f1cb10d0cdaf426408
SHA1

bda404cb5709a1f026c47a1c0508b2b753a47836
SHA256

7769af718266fcc91c9f39eb71d1b137156b95d6e6704d9b783988e3421ac656
SHA512

a1baa3532e2237a73e8ccc353b1e1de936ec49e2a3b995ae030092873f4f5bb74d7be47eb75e85a3da254f3d21c147e2327fa67b728e70ebe09d297ccc188179

Score

10^/10

hiddenlotus miner

Malware Config

Signatures

Hiddenlotus
Hiddenlotus family.
miner hiddenlotus

/bin/sh
sh -c "sudo open /Volumes/HiddedLotus/HiddedLotus.app"
1⤵
PID:463

/bin/bash
sh -c "sudo open /Volumes/HiddedLotus/HiddedLotus.app"
1⤵
PID:463

/usr/bin/sudo
sudo open /Volumes/HiddedLotus/HiddedLotus.app
1⤵
PID:463
- /usr/bin/open
  open /Volumes/HiddedLotus/HiddedLotus.app
  2⤵
  PID:464

/Volumes/HiddedLotus/HiddedLotus.app/Contents/MacOS/Lê Thu Hà (HAEDC)
"/Volumes/HiddedLotus/HiddedLotus.app/Contents/MacOS/Lê Thu Hà (HAEDC)"
1⤵
PID:467

/bin/sh
sh -c "osascript -e 'tell application \"Finder\"' -e 'set visible of process \"Terminal\" to false' -e 'end tell' > /dev/null 2>&1"
1⤵
PID:469

/bin/bash
sh -c "osascript -e 'tell application \"Finder\"' -e 'set visible of process \"Terminal\" to false' -e 'end tell' > /dev/null 2>&1"
1⤵
PID:469
- /usr/bin/osascript
  osascript -e "tell application \"Finder\"" -e "set visible of process \"Terminal\" to false" -e "end tell"
  2⤵
  PID:470

/bin/sh
sh -c "touch -t 1407112212 \"/Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd\" >/dev/null 2>&1"
1⤵
PID:472

/bin/bash
sh -c "touch -t 1407112212 \"/Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd\" >/dev/null 2>&1"
1⤵
PID:472
- /usr/bin/touch
  touch -t 1407112212 /Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd
  2⤵
  PID:473

/bin/sh
sh -c "touch -t 1407112212 \"/Users/run/Library/LaunchAgents/com.apple.hidd.shared.plist\" >/dev/null 2>&1"
1⤵
PID:474

/bin/bash
sh -c "touch -t 1407112212 \"/Users/run/Library/LaunchAgents/com.apple.hidd.shared.plist\" >/dev/null 2>&1"
1⤵
PID:474
- /usr/bin/touch
  touch -t 1407112212 /Users/run/Library/LaunchAgents/com.apple.hidd.shared.plist
  2⤵
  PID:475

/bin/sh
sh -c "launchctl load ~/Library/LaunchAgents/com.apple.hidd.shared.plist > /dev/null 2>&1 &"
1⤵
PID:476

/bin/sh
sh -c "mv -f \"/Volumes/HiddedLotus/HiddedLotus.app/Contents/Resources/configureDefault.sys\" \"/tmp/HiddedLotus.pdf\" > /dev/null 2>&1 ; open \"/tmp/HiddedLotus.pdf\" & > /dev/null 2>&1 ; rm -rf \"/Volumes/HiddedLotus/HiddedLotus.app\" > /dev/null 2>&1 ; cp -f \"/tmp/HiddedLotus.pdf\" \"/Volumes/HiddedLotus/HiddedLotus.pdf\" > /dev/null 2>&1 ; sleep 3 ; rm -rf \"/tmp/HiddedLotus.pdf\" > /dev/null 2>&1"
1⤵
PID:477

/bin/bash
sh -c "launchctl load ~/Library/LaunchAgents/com.apple.hidd.shared.plist > /dev/null 2>&1 &"
1⤵
PID:476
- /bin/launchctl
  launchctl load /Users/run/Library/LaunchAgents/com.apple.hidd.shared.plist
  2⤵
  PID:478

/bin/bash
sh -c "mv -f \"/Volumes/HiddedLotus/HiddedLotus.app/Contents/Resources/configureDefault.sys\" \"/tmp/HiddedLotus.pdf\" > /dev/null 2>&1 ; open \"/tmp/HiddedLotus.pdf\" & > /dev/null 2>&1 ; rm -rf \"/Volumes/HiddedLotus/HiddedLotus.app\" > /dev/null 2>&1 ; cp -f \"/tmp/HiddedLotus.pdf\" \"/Volumes/HiddedLotus/HiddedLotus.pdf\" > /dev/null 2>&1 ; sleep 3 ; rm -rf \"/tmp/HiddedLotus.pdf\" > /dev/null 2>&1"
1⤵
PID:477
- /bin/mv
  mv -f /Volumes/HiddedLotus/HiddedLotus.app/Contents/Resources/configureDefault.sys /tmp/HiddedLotus.pdf
  2⤵
  PID:479
- /usr/bin/open
  open /tmp/HiddedLotus.pdf
  2⤵
  PID:481
- /bin/rm
  rm -rf /Volumes/HiddedLotus/HiddedLotus.app
  2⤵
  PID:482
- /bin/cp
  cp -f /tmp/HiddedLotus.pdf /Volumes/HiddedLotus/HiddedLotus.pdf
  2⤵
  PID:483
- /bin/sleep
  sleep 3
  2⤵
  PID:488
- /bin/rm
  rm -rf /tmp/HiddedLotus.pdf
  2⤵
  PID:498

/usr/libexec/xpcproxy
xpcproxy com.apple.hidd.shared
1⤵
PID:480

/Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd
/Users/run/Library/Containers/com.apple.lateragent/Data/Library/Preferences/hidd
1⤵
PID:480

/bin/sh
sh -c "ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split(\$0, line, \"\\\"\"); printf(\"%s\", line[4]); }' 2>&1"
1⤵
PID:484

/bin/bash
sh -c "ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split(\$0, line, \"\\\"\"); printf(\"%s\", line[4]); }' 2>&1"
1⤵
PID:484
- /usr/sbin/ioreg
  ioreg -rd1 -c IOPlatformExpertDevice
  2⤵
  PID:485
- /usr/bin/awk
  awk "/IOPlatformSerialNumber/ { split(\$0, line, \"\\\"\"); printf(\"%s\", line[4]); }"
  2⤵
  PID:486

/bin/sh
sh -c "touch -t 1407112212 \"/Users/run/Library/Calendars/Calendar Sync Changes/Calendar Sync\" >/dev/null 2>&1"
1⤵
PID:489

/bin/bash
sh -c "touch -t 1407112212 \"/Users/run/Library/Calendars/Calendar Sync Changes/Calendar Sync\" >/dev/null 2>&1"
1⤵
PID:489
- /usr/bin/touch
  touch -t 1407112212 "/Users/run/Library/Calendars/Calendar Sync Changes/Calendar Sync"
  2⤵
  PID:490

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:491

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:491
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:492

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:493

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:493
- /usr/bin/uname
  uname -m
  2⤵
  PID:494

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:507

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:507
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:508

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:509

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:509
- /usr/bin/uname
  uname -m
  2⤵
  PID:510

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:542

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:542
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:543

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:544

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:544
- /usr/bin/uname
  uname -m
  2⤵
  PID:545

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:554

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:554
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:555

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:556

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:556
- /usr/bin/uname
  uname -m
  2⤵
  PID:557

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:579

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:579
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:580

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:581

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:581
- /usr/bin/uname
  uname -m
  2⤵
  PID:582

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:588

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:588
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:589

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:590

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:590
- /usr/bin/uname
  uname -m
  2⤵
  PID:591

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:597

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:597
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:598

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:599

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:599
- /usr/bin/uname
  uname -m
  2⤵
  PID:600

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:674

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:674
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:675

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:676

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:676
- /usr/bin/uname
  uname -m
  2⤵
  PID:677

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:696

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:696
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:697

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:698

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:698
- /usr/bin/uname
  uname -m
  2⤵
  PID:699

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:716

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:716
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:717

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:718

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:718
- /usr/bin/uname
  uname -m
  2⤵
  PID:719

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:732

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:732
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:733

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:734

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:734
- /usr/bin/uname
  uname -m
  2⤵
  PID:735

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:741

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:741
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:742

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:743

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:743
- /usr/bin/uname
  uname -m
  2⤵
  PID:744

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:746

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:746
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:747

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:748

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:748
- /usr/bin/uname
  uname -m
  2⤵
  PID:749

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:760

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:760
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:761

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:762

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:762
- /usr/bin/uname
  uname -m
  2⤵
  PID:763

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:766

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:766
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:767

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:768

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:768
- /usr/bin/uname
  uname -m
  2⤵
  PID:769

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:796

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:796
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:797

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:799

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:799
- /usr/bin/uname
  uname -m
  2⤵
  PID:800

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:816

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:816
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:817

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:818

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:818
- /usr/bin/uname
  uname -m
  2⤵
  PID:819

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:820

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:820
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:821

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:822

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:822
- /usr/bin/uname
  uname -m
  2⤵
  PID:823

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:824

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:824
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:825

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:826

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:826
- /usr/bin/uname
  uname -m
  2⤵
  PID:827

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:828

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:828
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:829

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:830

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:830
- /usr/bin/uname
  uname -m
  2⤵
  PID:831

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:832

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:832
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:833

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:834

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:834
- /usr/bin/uname
  uname -m
  2⤵
  PID:835

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:836

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:836
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:837

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:838

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:838
- /usr/bin/uname
  uname -m
  2⤵
  PID:839

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:840

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:840
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:841

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:842

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:842
- /usr/bin/uname
  uname -m
  2⤵
  PID:843

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:844

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:844
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:845

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:846

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:846
- /usr/bin/uname
  uname -m
  2⤵
  PID:847

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:848

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:848
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:849

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:850

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:850
- /usr/bin/uname
  uname -m
  2⤵
  PID:851

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:856

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:856
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:857

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:858

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:858
- /usr/bin/uname
  uname -m
  2⤵
  PID:859

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:861

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:861
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:862

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:863

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:863
- /usr/bin/uname
  uname -m
  2⤵
  PID:864

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:865

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:865
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:866

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:867

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:867
- /usr/bin/uname
  uname -m
  2⤵
  PID:868

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:869

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:869
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:870

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:871

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:871
- /usr/bin/uname
  uname -m
  2⤵
  PID:872

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:873

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:873
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:874

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:875

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:875
- /usr/bin/uname
  uname -m
  2⤵
  PID:876

/bin/sh
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:891

/bin/bash
sh -c "sw_vers -productVersion 2>&1"
1⤵
PID:891
- /usr/bin/sw_vers
  sw_vers -productVersion
  2⤵
  PID:892

/bin/sh
sh -c "uname -m 2>&1"
1⤵
PID:893

/bin/bash
sh -c "uname -m 2>&1"
1⤵
PID:893
- /usr/bin/uname
  uname -m
  2⤵
  PID:894

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads