Overview

overview

1

Static

static

1

a665cd40ef...36.zip

macos-10.15-amd64

1

Payload/XA...2x.png

macos-10.15-amd64

1

Payload/XA...lt.png

macos-10.15-amd64

1

Payload/XA...2x.png

macos-10.15-amd64

1

Payload/XA....plist

macos-10.15-amd64

1

Payload/XA...kgInfo

macos-10.15-amd64

1

Payload/XA....plist

macos-10.15-amd64

1

Payload/XA...gs.png

macos-10.15-amd64

1

Payload/XA...XAgent

macos-10.15-amd64

1

Payload/XA....xcent

macos-10.15-amd64

1

Payload/XA...es.xml

macos-10.15-amd64

1

Payload/XA...trings

macos-10.15-amd64

1

Payload/XA...-3.nib

macos-10.15-amd64

1

Payload/XA....plist

macos-10.15-amd64

1

Payload/XA...-2.nib

macos-10.15-amd64

1

Analysis

  • max time kernel
    131s
  • max time network
    153s
  • platform
    macos_amd64
  • resource
    macos-20220504-en
  • resource tags

    arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    17-03-2023 11:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Payload/XAgent.app/_CodeSignature/CodeResources.xml

  • Size

    4KB

  • MD5

    a454a3fb47ce064ab6be6adfa17a6622

  • SHA1

    931f84c08d3ad2f277e114a6782dca2d1c882d30

  • SHA256

    e43803aa01c08d0c46abe5bb177a887e13b0adde1ad9d8209bea7a4ccf446faa

  • SHA512

    4509813d779e1974007fe58bb1e75a42eeb28f1c8331092baa39fd81b4d1a71766f472329a0ff8fddcc8dd51c3de8849f54d2ec00947b45bdc334fee9331e4b3

  • SSDEEP

    96:Cy4V60qgNN/qrI47CAfUE93V601N/qrI47CAfUE9li/ndLDzFRioQsJvy:XEyEcCwnxyEcCwnEDzu

Score
1/10

Malware Config

Signatures

Processes

  • /usr/sbin/spctl
    /usr/sbin/spctl --status
    1⤵
      PID:492
    • /usr/sbin/spctl
      /usr/sbin/spctl --test-devid-status
      1⤵
        PID:494
      • /usr/bin/syslog
        /usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
        1⤵
          PID:495
        • /bin/sh
          sh -c "sudo /bin/zsh -c \"/Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml\""
          1⤵
            PID:496
          • /bin/bash
            sh -c "sudo /bin/zsh -c \"/Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml\""
            1⤵
              PID:496
            • /bin/bash
              sh -c "sudo /bin/zsh -c \"/Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml\""
              1⤵
                PID:496
              • /usr/bin/sudo
                sudo /bin/zsh -c /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                1⤵
                  PID:496
                • /usr/bin/sudo
                  sudo /bin/zsh -c /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                  1⤵
                    PID:496
                    • /bin/zsh
                      /bin/zsh -c /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                      2⤵
                        PID:509
                      • /bin/zsh
                        /bin/zsh -c /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                        2⤵
                          PID:509
                        • /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                          /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                          2⤵
                            PID:509
                          • /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                            /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                            2⤵
                              PID:509
                            • /bin/sh
                              sh /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                              2⤵
                                PID:509
                              • /bin/sh
                                sh /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                                2⤵
                                  PID:509
                                • /bin/bash
                                  sh /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                                  2⤵
                                    PID:509
                                  • /bin/bash
                                    sh /Users/run/Payload/XAgent.app/_CodeSignature/CodeResources.xml
                                    2⤵
                                      PID:509

                                  Network

                                  MITRE ATT&CK Matrix

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads