Analysis
-
max time kernel
147s -
max time network
145s -
platform
macos_amd64 -
resource
macos-20220504-en -
resource tags
arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
07/11/2022, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
7d61305f71019d81228a422486e4fba613ebb277
Resource
macos-20220504-en
0 signatures
150 seconds
General
-
Target
7d61305f71019d81228a422486e4fba613ebb277
-
Size
4KB
-
MD5
280382730313f900d359ba8c87e8d1cf
-
SHA1
7d61305f71019d81228a422486e4fba613ebb277
-
SHA256
10478c54f97e7cbee5de0c70903b6fd525a7bd21c0e089b123758a52106ab975
-
SHA512
9908193e6b83533ea3422130238b23c4bb95dc95d6f4e5e89ac05dd17dbbc7bdae038144bb226c35c620595279949d0b6a66c7b09a164ffc4598f680c0079d79
-
SSDEEP
96:T9BTAWX8YH0ve/TyuzVXJ87ymttMtUCwdAbDD7dedx0CJ7hCos5q:T9rBHEOxXJ87VtO2CuALRgx97hW5q
Score
1/10
Malware Config
Signatures
Processes
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵PID:503
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/7d61305f71019d81228a422486e4fba613ebb277\""1⤵PID:504
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/7d61305f71019d81228a422486e4fba613ebb277\""1⤵PID:504
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/7d61305f71019d81228a422486e4fba613ebb277\""1⤵PID:504
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/7d61305f71019d81228a422486e4fba613ebb2771⤵PID:504
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/7d61305f71019d81228a422486e4fba613ebb2771⤵PID:504
-
/bin/zsh/bin/zsh -c /Users/run/7d61305f71019d81228a422486e4fba613ebb2772⤵PID:505
-
-
/bin/zsh/bin/zsh -c /Users/run/7d61305f71019d81228a422486e4fba613ebb2772⤵PID:505
-
-
/Users/run/7d61305f71019d81228a422486e4fba613ebb277/Users/run/7d61305f71019d81228a422486e4fba613ebb2772⤵PID:505
-
-
/Users/run/7d61305f71019d81228a422486e4fba613ebb277/Users/run/7d61305f71019d81228a422486e4fba613ebb2772⤵PID:505
-
-
/usr/bin/zshzsh /Users/run/7d61305f71019d81228a422486e4fba613ebb2772⤵PID:505
-
-
/usr/bin/zshzsh /Users/run/7d61305f71019d81228a422486e4fba613ebb2772⤵PID:505
-
-
/bin/zshzsh /Users/run/7d61305f71019d81228a422486e4fba613ebb2772⤵PID:505
-
-
/bin/zshzsh /Users/run/7d61305f71019d81228a422486e4fba613ebb2772⤵PID:505
-
/usr/bin/dirnamedirname /Users/run/7d61305f71019d81228a422486e4fba613ebb2773⤵PID:511
-
-
/usr/bin/dirnamedirname /Users/run/7d61305f71019d81228a422486e4fba613ebb2773⤵PID:511
-
-
/usr/bin/dirnamedirname /Users/run3⤵PID:512
-
-
/usr/bin/dirnamedirname /Users/run3⤵PID:512
-
-
-
/usr/bin/revrev1⤵PID:510
-
/usr/bin/revrev1⤵PID:510