Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time network
152s -
platform
macos_amd64 -
resource
macos -
submitted
24/06/2021, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
GravityRAT.macho
Resource
macos
0 signatures
0 seconds
General
-
Target
GravityRAT.macho
-
Size
16.4MB
-
MD5
296c1e8f4d8c997ca410a5d9b33e62ca
-
SHA1
086b22075d464b327a2bcbf8b66736560a215347
-
SHA256
70454f1794ee4626a9d70f58aa570bca14da1c40432a2dd1bec5f51b0efcc13f
-
SHA512
e779f1d48f90eea1400b97ddb14364129abcd4881d84ccc807f0c8585263bd57e0b102456d3ee6d68adbea6221cc0956baabc851bd649ca35d06861f89a1f2fe
Score
10/10
Malware Config
Signatures
-
GravityRAT
GravityRAT family.
Processes
-
/bin/shsh -c "sudo /Users/run/GravityRAT.macho"1⤵PID:482
-
/bin/bashsh -c "sudo /Users/run/GravityRAT.macho"1⤵PID:482
-
/usr/bin/sudosudo /Users/run/GravityRAT.macho1⤵PID:482
-
/Users/run/GravityRAT.macho/Users/run/GravityRAT.macho2⤵PID:488
-
/Users/run/GravityRAT.macho/Users/run/GravityRAT.macho3⤵PID:492
-
-
-
/bin/shsh -c "uname -p 2> /dev/null"1⤵PID:494
-
/bin/bashsh -c "uname -p 2> /dev/null"1⤵PID:494
-
/usr/bin/unameuname -p2⤵PID:495
-
-
/bin/shsh -c "ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\\" '/product-name/{print \$(NF-1)}'"1⤵PID:496
-
/bin/bashsh -c "ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\\" '/product-name/{print \$(NF-1)}'"1⤵PID:496
-
/usr/sbin/ioregioreg -c IOPlatformExpertDevice -d 22⤵PID:497
-
-
/usr/bin/awkawk "-F\"" "/product-name/{print \$(NF-1)}"2⤵PID:498
-
-
/bin/shsh -c "ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\\" '/board-id/{print \$(NF-1)}'"1⤵PID:499
-
/bin/bashsh -c "ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\\" '/board-id/{print \$(NF-1)}'"1⤵PID:499
-
/usr/sbin/ioregioreg -c IOPlatformExpertDevice -d 22⤵PID:500
-
-
/usr/bin/awkawk "-F\"" "/board-id/{print \$(NF-1)}"2⤵PID:501
-
-
/bin/shsh -c "ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\\" '/manufacturer/{print \$(NF-1)}'"1⤵PID:502
-
/bin/bashsh -c "ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\\" '/manufacturer/{print \$(NF-1)}'"1⤵PID:502
-
/usr/bin/awkawk "-F\"" "/manufacturer/{print \$(NF-1)}"2⤵PID:504
-
-
/usr/sbin/ioregioreg -c IOPlatformExpertDevice -d 22⤵PID:503
-
-
/bin/shsh -c "ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\\" '/model/{print \$(NF-1)}'"1⤵PID:505
-
/bin/bashsh -c "ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\\" '/model/{print \$(NF-1)}'"1⤵PID:505
-
/usr/sbin/ioregioreg -c IOPlatformExpertDevice -d 22⤵PID:506
-
-
/usr/bin/awkawk "-F\"" "/model/{print \$(NF-1)}"2⤵PID:507
-
-
/bin/shsh -c "ls ~/Library/Safari"1⤵PID:508
-
/bin/bashsh -c "ls ~/Library/Safari"1⤵PID:508
-
/bin/lsls /Users/run/Library/Safari1⤵PID:508