Analysis
-
max time kernel
143s -
max time network
151s -
platform
macos_amd64 -
resource
macos-20220504-en -
resource tags
arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
11/01/2023, 21:39
Static task
static1
Behavioral task
behavioral1
Sample
Data/532204087_1355x1355-small-230.jpg
Resource
macos-20220504-en
Behavioral task
behavioral2
Sample
Data/532205080_1647x1098-small-234.jpg
Resource
macos-20220504-en
Behavioral task
behavioral3
Sample
Data/532241774_2880x1920-small-223.jpg
Resource
macos-20220504-en
Behavioral task
behavioral4
Sample
Data/IMG_0556-353.jpg
Resource
macos-20220504-en
Behavioral task
behavioral5
Sample
Data/IMG_0556-small-354.jpg
Resource
macos-20220504-en
Behavioral task
behavioral6
Sample
Metadata/BuildVersionHistory.xml
Resource
macos-20220504-en
General
-
Target
Data/IMG_0556-353.jpg
-
Size
263KB
-
MD5
0cf0813ceea9b959343aa4a329230240
-
SHA1
ea1cd1e8864a12dbd8f62f1dd9b163af46167d94
-
SHA256
3ae7cef2bc1f2c6f51a967cf3b24b06d9a23a68d3b522ba02f3810d8812f6fcc
-
SHA512
8726be64756d281845ae03af5dc68092a8a66fc59ebbbf7d028abf4cad9cf02998cd8f9f4043dbd17b9ef185dc4e37c9907637c8d5614f79c74856517a1b4fd3
-
SSDEEP
6144:Q387V90qAWJKZsyGIfw/2vtDbY8M/41imZXQjeI7tq:Q3Rq4eyGIfwuVnY8M/4QmGVA
Malware Config
Signatures
Processes
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵PID:508
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Data/IMG_0556-353.jpg\""1⤵PID:510
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Data/IMG_0556-353.jpg\""1⤵PID:510
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Data/IMG_0556-353.jpg\""1⤵PID:510
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Data/IMG_0556-353.jpg1⤵PID:510
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Data/IMG_0556-353.jpg1⤵PID:510
-
/bin/zsh/bin/zsh -c /Users/run/Data/IMG_0556-353.jpg2⤵PID:517
-
-
/bin/zsh/bin/zsh -c /Users/run/Data/IMG_0556-353.jpg2⤵PID:517
-
-
/Users/run/Data/IMG_0556-353.jpg/Users/run/Data/IMG_0556-353.jpg2⤵PID:517
-
-
/Users/run/Data/IMG_0556-353.jpg/Users/run/Data/IMG_0556-353.jpg2⤵PID:517
-