Overview

overview

1

Static

static

1

main.zip

macos-10.15-amd64

1

Analysis

  • max time kernel
    53s
  • max time network
    64s
  • platform
    macos_amd64
  • resource
    macos-20220504-en
  • resource tags

    arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    10/03/2023, 23:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    main.zip

  • Size

    20.9MB

  • MD5

    87a51f978eedb0849ce83892a36d0b8a

  • SHA1

    5b99cb42dbdd74f8121f23b22886a6dc13bf922a

  • SHA256

    2c5b56c9a2b588a58f0018d7391d4d503c1dd971ba7633a681267ac2e4377384

  • SHA512

    7c2a1ab7982ccb533b1a570b2b14444b248ab0e3d44d2f8cf9acb4af35cb2b5079181259a4d23c5d490578c0f1c49d5e705c3b63a9220aab4e8e9f4abe19b1e1

  • SSDEEP

    393216:su3Li6IRU5l+dbT9GA1dLfMntFb62fG+3mkkTB2oDB3HRcZt+QHvCFibrwNZf0X1:pb2ULETZVfWyU3mtIo0Zt+KCFkrs6WVA

Score
1/10

Malware Config

Signatures

Processes

  • /usr/sbin/spctl
    /usr/sbin/spctl --test-devid-status
    1⤵
      PID:502
    • /usr/bin/syslog
      /usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
      1⤵
        PID:503
      • /bin/sh
        sh -c "sudo /bin/zsh -c \"/Users/run/main.zip\""
        1⤵
          PID:504
        • /bin/bash
          sh -c "sudo /bin/zsh -c \"/Users/run/main.zip\""
          1⤵
            PID:504
          • /bin/bash
            sh -c "sudo /bin/zsh -c \"/Users/run/main.zip\""
            1⤵
              PID:504
            • /usr/bin/sudo
              sudo /bin/zsh -c /Users/run/main.zip
              1⤵
                PID:504
              • /usr/bin/sudo
                sudo /bin/zsh -c /Users/run/main.zip
                1⤵
                  PID:504
                  • /bin/zsh
                    /bin/zsh -c /Users/run/main.zip
                    2⤵
                      PID:505
                    • /bin/zsh
                      /bin/zsh -c /Users/run/main.zip
                      2⤵
                        PID:505
                      • /Users/run/main.zip
                        /Users/run/main.zip
                        2⤵
                          PID:505
                        • /Users/run/main.zip
                          /Users/run/main.zip
                          2⤵
                            PID:505
                        • /usr/bin/bzip2
                          /usr/bin/bzip2 -f /var/log/wifi.log.0
                          1⤵
                            PID:524
                          • /usr/libexec/xpcproxy
                            xpcproxy com.apple.metadata.mdwrite
                            1⤵
                              PID:526
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.archiveutility.2568
                              1⤵
                                PID:527
                              • /System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
                                "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility"
                                1⤵
                                  PID:527
                                • /usr/bin/macbinary
                                  /usr/bin/macbinary probe --verbose /Users/run/main.zip
                                  1⤵
                                    PID:529
                                  • /usr/bin/file
                                    /usr/bin/file -b /Users/run/main.zip
                                    1⤵
                                      PID:530
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.archiveutility.auhelperservice 527
                                      1⤵
                                        PID:531
                                      • /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
                                        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
                                        1⤵
                                          PID:531
                                        • /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
                                          /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
                                          1⤵
                                            PID:533
                                          • /usr/libexec/xpcproxy
                                            xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 527
                                            1⤵
                                              PID:535
                                            • /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
                                              /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
                                              1⤵
                                                PID:535
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.quicklook.satellite.CDA160B6-32C9-4F00-9BF0-54DD9564F0B0 536
                                                1⤵
                                                  PID:537
                                                • /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
                                                  /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
                                                  1⤵
                                                    PID:537
                                                  • /usr/libexec/xpcproxy
                                                    xpcproxy com.apple.DictionaryServiceHelper
                                                    1⤵
                                                      PID:538
                                                    • /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
                                                      /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
                                                      1⤵
                                                        PID:538
                                                      • /usr/local/bin/python3
                                                        python3
                                                        1⤵
                                                          PID:542
                                                        • /usr/local/bin/python3
                                                          python3
                                                          1⤵
                                                            PID:542
                                                          • /usr/local/Cellar/[email protected]/3.9.7_1/Frameworks/Python.framework/Versions/3.9/Resources/Python.app/Contents/MacOS/Python
                                                            "/usr/local/Cellar/[email protected]/3.9.7_1/Frameworks/Python.framework/Versions/3.9/Resources/Python.app/Contents/MacOS/Python"
                                                            1⤵
                                                              PID:542
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.PerformanceAnalysis.animationperfd
                                                              1⤵
                                                                PID:547
                                                              • /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                1⤵
                                                                  PID:547

                                                                Network

                                                                MITRE ATT&CK Matrix

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/main.app/Contents/Info.plist
                                                                  Filesize

                                                                  692B

                                                                  MD5

                                                                  70c924592cbb1aeea83ec35f26d51382

                                                                  SHA1

                                                                  3518d883df621446f4d5e4bc6ba1522e32a40d31

                                                                  SHA256

                                                                  c105f55a029d9946d5db232620024bdabc96655cb1917062ef92aa472334b7df

                                                                  SHA512

                                                                  d7233e5424fb982cb64ade203952fe544dfb8205c869e9f3ce7c61e2bed1279616af1a6344cec07551699f78c5b3687e75a3d9ae5f18e31fef2407cc0fe67e65

                                                                  Download Submit

                                                                • /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/main.app/Contents/MacOS/main
                                                                  Filesize

                                                                  21.1MB

                                                                  MD5

                                                                  d50e33620a5e6203d39f651c0161d741

                                                                  SHA1

                                                                  3143d27cbab71aff59f73616b26073b09dbbb9f4

                                                                  SHA256

                                                                  6d3943b637c8dfb680d23247b95c756b896aa07fe8a61fdcc86b6b7a30b6f9af

                                                                  SHA512

                                                                  c55a660c16759096b274ee031f728f891c163f822bf67c1e461fa4af34776cc6d6eba52ab3b9cba4e736fc5db1e214e24e05c41a30cabbf711e928afbdf90cbd

                                                                  Download Submit

                                                                • /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/main.app/Contents/Resources/icon-windowed.icns
                                                                  Filesize

                                                                  107KB

                                                                  MD5

                                                                  a7147eed15f43df855e18ff5379059db

                                                                  SHA1

                                                                  7841ceb98a592c1d2f28654858664e879ac7f3ea

                                                                  SHA256

                                                                  b90a3b56e59169be0f86fe0410699f42ccaa16a0c85d980ef0eb6068032f0b36

                                                                  SHA512

                                                                  7aad091df5f44b57b40b38916dad04e76de72af45d786624df8a691841635cf4afbdcf78eeb303aec6ad15473b9f263900eedff99d91c94876ace9c4d0d9012e

                                                                  Download Submit

                                                                • /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.fileprovider.ArchiveService/TemporaryItems/(A Document Being Saved By ArchiveService)/main.app/Contents/_CodeSignature/CodeResources
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  c82aa4fd1ee8ba01c5dedc7e40277d33

                                                                  SHA1

                                                                  5a42bd486157effcc10eda35ab4d712e44ed4ec5

                                                                  SHA256

                                                                  65f1a83698b6cf05373691ffb5db5105c2f22362b934c305bb371462de8a059a

                                                                  SHA512

                                                                  3e1bf42b02cb7e1b6c1b5464178bb754694d065668d6ca9331a1b8735c069b5d6fd51a71a59826b30293f471dbfff0d2f66b8a6d0be62cf9fdc1325b189a8f19

                                                                  Download Submit

                                                                • /private/var/log/wifi.log.0.bz2
                                                                  Filesize

                                                                  638B

                                                                  MD5

                                                                  eb8195e1dcb09b23cfd9f8e5b72a61ea

                                                                  SHA1

                                                                  483f2bd77c15e60c1f1678eea26bab57f47faf22

                                                                  SHA256

                                                                  c2c2ba3de1ca4e26c1267d64e2f4228b05af3ad398da134166367bfedbec0b5a

                                                                  SHA512

                                                                  9783cd0c9f5dcd24e65d4b87f2f5d2d0854c43628fc357ee7e4a19bd48ccd4720faf83536b28794719d3a49173c7e001a8faf2f94827242ad2495cf876824e7e

                                                                  Download Submit

                                                                • /private/var/log/wifi.log.0.bz2
                                                                  Filesize

                                                                  638B

                                                                  MD5

                                                                  eb8195e1dcb09b23cfd9f8e5b72a61ea

                                                                  SHA1

                                                                  483f2bd77c15e60c1f1678eea26bab57f47faf22

                                                                  SHA256

                                                                  c2c2ba3de1ca4e26c1267d64e2f4228b05af3ad398da134166367bfedbec0b5a

                                                                  SHA512

                                                                  9783cd0c9f5dcd24e65d4b87f2f5d2d0854c43628fc357ee7e4a19bd48ccd4720faf83536b28794719d3a49173c7e001a8faf2f94827242ad2495cf876824e7e

                                                                  Download Submit

                                                                • /usr/local/Cellar/[email protected]/3.9.7_1/Frameworks/Python.framework/Versions/3.9/lib/python3.9/__pycache__/rlcompleter.cpython-39.pyc.4325386928
                                                                  Filesize

                                                                  5KB

                                                                  MD5

                                                                  f29376ff18f318ae25e270486d928b21

                                                                  SHA1

                                                                  a15af54025a34eed4f1ef6184500f2bfc31d5304

                                                                  SHA256

                                                                  b46189e474e844fb9299501e414a853c5bf3c4d8b12e47f04fc7e35808ac7dd5

                                                                  SHA512

                                                                  e6dda5a2bc148b8bd711d0cbfa33d5076ecac1f41b6ab411a886245ed5a887b747f7fc7b548bcdc6dbc4fe95b190f408081858f166d89add388b027b338d7e94

                                                                  Download Submit