Overview

overview

1

Static

static

BloodHack.exe

macos-10.15-amd64

1

Resubmissions

01-11-2022 19:49

221101-yj68dafdej 1

01-11-2022 19:47

221101-yhsctsfddk 8

Analysis

  • max time kernel
    136s
  • max time network
    125s
  • platform
    macos_amd64
  • resource
    macos-20220504-en
  • resource tags

    arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    01-11-2022 19:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BloodHack.exe

  • Size

    1.8MB

  • MD5

    2370961b355c2c24ff7e6f2d850ab5e4

  • SHA1

    626655e8c4f9314be8726a1bdc0b4e87e4f4e847

  • SHA256

    9ca6536a01be198a9cad4d1df7c6d0e2c6b7d6f88ff8c8399534e93a6708565e

  • SHA512

    adbe5ce312b3bd341fbf551310260869429c29dea819d427c1644b4532e7e5c48580bec3675b9107149548e312a734e543e603cb7e81cda1bb533a647328c974

  • SSDEEP

    49152:/7n282hBSMnIQJwJ+YP/QAPYTysIWEOifkTOn:/7n2hCMI0wJAui

Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/BloodHack.exe\""
    1⤵
      PID:504
    • /usr/bin/syslog
      /usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
      1⤵
        PID:503
      • /bin/bash
        sh -c "sudo /bin/zsh -c \"/Users/run/BloodHack.exe\""
        1⤵
          PID:504
        • /bin/bash
          sh -c "sudo /bin/zsh -c \"/Users/run/BloodHack.exe\""
          1⤵
            PID:504
          • /usr/bin/sudo
            sudo /bin/zsh -c /Users/run/BloodHack.exe
            1⤵
              PID:504
            • /usr/bin/sudo
              sudo /bin/zsh -c /Users/run/BloodHack.exe
              1⤵
                PID:504
                • /bin/zsh
                  /bin/zsh -c /Users/run/BloodHack.exe
                  2⤵
                    PID:505
                  • /bin/zsh
                    /bin/zsh -c /Users/run/BloodHack.exe
                    2⤵
                      PID:505
                    • /Users/run/BloodHack.exe
                      /Users/run/BloodHack.exe
                      2⤵
                        PID:505
                      • /Users/run/BloodHack.exe
                        /Users/run/BloodHack.exe
                        2⤵
                          PID:505
                      • /usr/bin/login
                        login -pf run
                        1⤵
                          PID:529
                        • /usr/bin/login
                          login -pf run
                          1⤵
                            PID:529
                            • /bin/zsh
                              -zsh
                              2⤵
                                PID:530
                              • /bin/zsh
                                -zsh
                                2⤵
                                  PID:530
                                  • /usr/libexec/path_helper
                                    /usr/libexec/path_helper -s
                                    3⤵
                                      PID:531
                                    • /usr/libexec/path_helper
                                      /usr/libexec/path_helper -s
                                      3⤵
                                        PID:531
                                      • /usr/bin/locale
                                        locale LC_CTYPE
                                        3⤵
                                          PID:532
                                        • /usr/bin/locale
                                          locale LC_CTYPE
                                          3⤵
                                            PID:532

                                      Network

                                      MITRE ATT&CK Matrix

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • /private/var/run/utmpx
                                        Filesize

                                        3KB

                                        MD5

                                        b8b2b0d749640da6cefb796a4e762790

                                        SHA1

                                        9a632e15e8dcf8bef40a85eef7881f1d30edf8f0

                                        SHA256

                                        394e174c48eaf914edb25825e5049cf44bc650b199d2251db65e7143c4bf9a82

                                        SHA512

                                        dea2869eb57f31693445f0453ce467cbd2c2804117280ef71284d1711e98233ce11d983095e73eb28b4e94192fa4a4f5a5bb2f89eadc87ed31be631aa303b283

                                        Download Submit

                                      • /private/var/run/utmpx
                                        Filesize

                                        3KB

                                        MD5

                                        b8b2b0d749640da6cefb796a4e762790

                                        SHA1

                                        9a632e15e8dcf8bef40a85eef7881f1d30edf8f0

                                        SHA256

                                        394e174c48eaf914edb25825e5049cf44bc650b199d2251db65e7143c4bf9a82

                                        SHA512

                                        dea2869eb57f31693445f0453ce467cbd2c2804117280ef71284d1711e98233ce11d983095e73eb28b4e94192fa4a4f5a5bb2f89eadc87ed31be631aa303b283

                                        Download Submit