a665cd40efaca89e9257d083328e13446428281d133895f984e847d93634e736

Analysis

max time kernel
133s
max time network
151s
platform
macos_amd64
resource
macos-20220504-en
resource tags

arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
17/03/2023, 11:45

Target

Payload/XAgent.app/[email protected]
Size

6KB
MD5

91c3f2a15fe0f2d0b9ff04a00c04ccca
SHA1

7fe7216da943fdc8341ba473b0e3dba475184008
SHA256

2eb2c7ad3a1db6359841124a3e47c2da05ebcf10e94001ad8c98468e48438775
SHA512

4225909e01871fdc2ddcb0d3893ea12f3327206e551958ea527aeec6ac0e3c5c422ce4327cf9648b01ee8fbd9f75f5fc84d5744e1f7c8cfc7d378d083a392813
SSDEEP

48:VRIwY19T76QChD9hkKiX4v8M8hF9sEvWnW7ZkId/vUcE/60bTifY7:VRIiQcBhkKiM8hFq0ZkIdUzS0K6

Score

1^/10

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/XAgent.app/[email protected]\""
1⤵
PID:494

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/XAgent.app/[email protected]\""
1⤵
PID:494

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/XAgent.app/[email protected]\""
1⤵
PID:494

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Payload/XAgent.app/[email protected]"
1⤵
PID:494

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Payload/XAgent.app/[email protected]"
1⤵
PID:494
- /bin/zsh
  /bin/zsh -c "/Users/run/Payload/XAgent.app/[email protected]"
  2⤵
  PID:508
- /bin/zsh
  /bin/zsh -c "/Users/run/Payload/XAgent.app/[email protected]"
  2⤵
  PID:508
- /Users/run/Payload/XAgent.app/[email protected]
  "/Users/run/Payload/XAgent.app/[email protected]"
  2⤵
  PID:508
- /Users/run/Payload/XAgent.app/[email protected]
  "/Users/run/Payload/XAgent.app/[email protected]"
  2⤵
  PID:508

/usr/bin/syslog
/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
1⤵
PID:509