gimmick | 2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f

Resubmissions

12-04-2022 19:35

220412-yarfkaafg8 1

23-03-2022 19:14

220323-xxws5aada5 1

23-03-2022 19:11

220323-xwehfsehen 1

Analysis

max time kernel
146s
max time network
143s
platform
macos_amd64
resource
macos
submitted
23-03-2022 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
Size

713KB
MD5

23699799f496b8e872d05f19d2b397f8
SHA1

fe3a3e65b86d2b07654f9a6104c8cb392c88b7e8
SHA256

2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f
SHA512

f347c47afe06ed7ef2a71b7e40ac0103f4f33e26250661173775b349bba7452ea458e5d4137a57b34801556959bca14093a9f693d59c147061f63f2b78614288

Score

10^/10

gimmick backdoor

Malware Config

Signatures

Gimmick
Gimmick family.
backdoor gimmick

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr\""
1⤵
PID:604

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr\""
1⤵
PID:604

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr\""
1⤵
PID:604

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
1⤵
PID:604

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
1⤵
PID:604
- /bin/zsh
  /bin/zsh -c /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  2⤵
  PID:606
- /bin/zsh
  /bin/zsh -c /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  2⤵
  PID:606
- /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  2⤵
  PID:606
- /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  2⤵
  PID:606

/bin/sh
sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
1⤵
PID:607

/bin/bash
sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
1⤵
PID:607

/bin/bash
sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
1⤵
PID:607
- /bin/ps
  ps -ef
  2⤵
  PID:610
- /bin/ps
  ps -ef
  2⤵
  PID:610
- /usr/bin/grep
  grep CorelDRAW
  2⤵
  PID:611
- /usr/bin/grep
  grep CorelDRAW
  2⤵
  PID:611
- /usr/bin/grep
  grep -v "CorelDRAW\\s*Graphics\\s*Suite"
  2⤵
  PID:613
- /usr/bin/grep
  grep -v "CorelDRAW\\s*Graphics\\s*Suite"
  2⤵
  PID:613
- /usr/bin/grep
  grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  2⤵
  PID:612
- /usr/bin/grep
  grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  2⤵
  PID:612
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:616
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:616
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:615
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:615

/usr/bin/kill
kill -9 611 613
1⤵
PID:618

/usr/bin/kill
kill -9 611 613
1⤵
PID:618

/bin/kill
kill -9 611 613
1⤵
PID:618

/bin/kill
kill -9 611 613
1⤵
PID:618

/bin/sh
sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
1⤵
PID:619

/bin/bash
sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
1⤵
PID:619

/bin/bash
sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
1⤵
PID:619
- /bin/ps
  ps -ef
  2⤵
  PID:620
- /bin/ps
  ps -ef
  2⤵
  PID:620
- /usr/bin/grep
  grep CorelDRAW
  2⤵
  PID:621
- /usr/bin/grep
  grep CorelDRAW
  2⤵
  PID:621
- /usr/bin/grep
  grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  2⤵
  PID:622
- /usr/bin/grep
  grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr
  2⤵
  PID:622
- /usr/bin/grep
  grep -v "CorelDRAW\\s*Graphics\\s*Suite"
  2⤵
  PID:623
- /usr/bin/grep
  grep -v "CorelDRAW\\s*Graphics\\s*Suite"
  2⤵
  PID:623
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:624
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:624
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:625
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:625

/usr/bin/kill
kill -9 621 623
1⤵
PID:626

/usr/bin/kill
kill -9 621 623
1⤵
PID:626

/bin/kill
kill -9 621 623
1⤵
PID:626

/bin/kill
kill -9 621 623
1⤵
PID:626

/bin/sh
sh -c "cp /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr /var/root/Library/Preferences/CorelDRAW/CorelDRAW"
1⤵
PID:627

/bin/bash
sh -c "cp /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr /var/root/Library/Preferences/CorelDRAW/CorelDRAW"
1⤵
PID:627

/bin/bash
sh -c "cp /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr /var/root/Library/Preferences/CorelDRAW/CorelDRAW"
1⤵
PID:627

/bin/cp
cp /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr /var/root/Library/Preferences/CorelDRAW/CorelDRAW
1⤵
PID:627

/bin/cp
cp /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr /var/root/Library/Preferences/CorelDRAW/CorelDRAW
1⤵
PID:627

/bin/sh
sh -c "launchctl unload -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
1⤵
PID:628

/bin/bash
sh -c "launchctl unload -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
1⤵
PID:628

/bin/bash
sh -c "launchctl unload -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
1⤵
PID:628

/bin/launchctl
launchctl unload -w /Library/LaunchDaemons/com.CorelDRAW.va.plist
1⤵
PID:628

/bin/launchctl
launchctl unload -w /Library/LaunchDaemons/com.CorelDRAW.va.plist
1⤵
PID:628

/bin/sh
sh -c "launchctl load -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
1⤵
PID:629

/bin/bash
sh -c "launchctl load -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
1⤵
PID:629

/bin/bash
sh -c "launchctl load -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
1⤵
PID:629

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.CorelDRAW.va.plist
1⤵
PID:629

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.CorelDRAW.va.plist
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.CorelDRAW.va.plist
1⤵
PID:630

/var/root/Library/Preferences/CorelDRAW/CorelDRAW
/var/root/Library/Preferences/CorelDRAW/CorelDRAW
1⤵
PID:630

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" "-Djdk.disableLastUsageTracking=true" "-Djava.awt.headless=true " -cp "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy.jar" com.sun.deploy.panel.ControlPanel -getSecurityLevel
1⤵
PID:639

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/LaunchDaemons/.dat.nosync025e.9yWw5l

Filesize
582B

MD5
93b1fba1725a0553ae1c33b7e9f507d3

SHA1
4eaef620d7c09baafa96d6ee7d40cc5c8925fe23

SHA256
3fff484073e2dcb8e724bb6527bcea19afeb9408bc179b358b299e369b7b0937

SHA512
5d3a52b8b513354409fc1793d89b3cc51863cdce732a06f3a01c66944db4832acb4c9e6dffc30ff05cb6fb5ca438326bdff5149eccc10be8a8adb57a728aff24

Download Submit
/Users/run/Library/Application Support/Oracle/Java/Deployment/deployment.properties

Filesize
613B

MD5
6e59bfcc2f5e6d71f5c65676f49a04b4

SHA1
87d43d9bd0cae384d733de9a31c0b7e09b399b42

SHA256
55f9406f617099c6da381ae6ee13283206f35dbac92a4021f0bf3a357782d67f

SHA512
2340c20caae971b5d077c55ffd42e6aa4a276fb7ccf9282745fef4e5c032b69ed18846c9009e545b35cbb8007df5b5a43d356f21715ba19369d578933684ccbb

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/hsperfdata_run/639

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/CorelDRAW

Filesize
713KB

MD5
23699799f496b8e872d05f19d2b397f8

SHA1
fe3a3e65b86d2b07654f9a6104c8cb392c88b7e8

SHA256
2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f

SHA512
f347c47afe06ed7ef2a71b7e40ac0103f4f33e26250661173775b349bba7452ea458e5d4137a57b34801556959bca14093a9f693d59c147061f63f2b78614288

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/CorelDRAW

Filesize
713KB

MD5
23699799f496b8e872d05f19d2b397f8

SHA1
fe3a3e65b86d2b07654f9a6104c8cb392c88b7e8

SHA256
2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f

SHA512
f347c47afe06ed7ef2a71b7e40ac0103f4f33e26250661173775b349bba7452ea458e5d4137a57b34801556959bca14093a9f693d59c147061f63f2b78614288

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.18xiEQ

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.35wL2e

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.4FWbzX

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.5puuoh

Filesize
160B

MD5
d31536852b73a989a08281b60e97e7b0

SHA1
09f80a2d185c1e58b4ff2adec8094e31cad55a50

SHA256
cf26f5c4da051c634ec328a464a81cded2bd77a3fb936a21ba4f78dd5f6813af

SHA512
df023b0f7b9db34900942ecd7059313b267943e0fba8ceea5665d78919a2dbdaaf9d9dc4a7bb1fddc9e2f0f60d666833c794640de286a7acf0a912412e2f6305

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.DW7Hkm

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.ZZSI1S

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.kLxNt5

Filesize
576B

MD5
20134ebea260d8147e0973d909c5ec76

SHA1
f5f3af403c8490a928917b96d027d00bf531a2d1

SHA256
227dc0ed1d597d9346fa0f2879d3107a85dc56b6f1e072f2d7d6848b7061e169

SHA512
b9041fa31fc5fe6e96a48fced220c6eb124eccaaf31d51947bc9b62e341bdbe3b8db83ec34eb2d4b2328740a27f3de7d38a154569293d4d5d32e151bd11b8d91

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.pZ6nPL

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.psSdA3

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.sNqyaS

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.u9cQvd

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit
/private/var/root/Library/Preferences/CorelDRAW/MGD/tmp/.dat.nosync0276.wMLrH9

Filesize
37B

MD5
c0238a4201674b71c06684994556a818

SHA1
402b10d5989c24997ce373729515201c918ac031

SHA256
67d07ff7678879c8ce5491b1999373d18f158640f65627379d0ec37c7f807e52

SHA512
3bf11c0e0c9521afbb088caa110ef0b7a9093e1ba4a3cb917ccbe56f964964f402eb58db20ebcbd8e67c3fff5f009e27753b2b8b471e4f3f95b5d3e78a6a6836

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads