a665cd40efaca89e9257d083328e13446428281d133895f984e847d93634e736 | Triage

Submit
Reports

Overview

overview

1

Static

static

1

a665cd40ef...36.zip

macos-10.15-amd64

1

Payload/XA...2x.png

macos-10.15-amd64

1

Payload/XA...lt.png

macos-10.15-amd64

1

Payload/XA...2x.png

macos-10.15-amd64

1

Payload/XA....plist

macos-10.15-amd64

1

Payload/XA...kgInfo

macos-10.15-amd64

1

Payload/XA....plist

macos-10.15-amd64

1

Payload/XA...gs.png

macos-10.15-amd64

1

Payload/XA...XAgent

macos-10.15-amd64

1

Payload/XA....xcent

macos-10.15-amd64

1

Payload/XA...es.xml

macos-10.15-amd64

1

Payload/XA...trings

macos-10.15-amd64

1

Payload/XA...-3.nib

macos-10.15-amd64

1

Payload/XA....plist

macos-10.15-amd64

1

Payload/XA...-2.nib

macos-10.15-amd64

1

Analysis

max time kernel
142s
max time network
128s
platform
macos_amd64
resource
macos-20220504-en
resource tags

arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
17-03-2023 11:45

Sharing

Static task

static1

Behavioral task

behavioral1

Sample

a665cd40efaca89e9257d083328e13446428281d133895f984e847d93634e736.zip

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

Payload/XAgent.app/[email protected]

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

Payload/XAgent.app/Default.png

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

Payload/XAgent.app/[email protected]

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

Payload/XAgent.app/Info.plist

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

Payload/XAgent.app/PkgInfo

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

Payload/XAgent.app/ResourceRules.plist

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Payload/XAgent.app/Settings.png

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Payload/XAgent.app/XAgent

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Payload/XAgent.app/XAgent.xcent

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

Payload/XAgent.app/_CodeSignature/CodeResources.xml

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

Payload/XAgent.app/en.lproj/InfoPlist.strings

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

Payload/XAgent.app/en.lproj/MainStoryboard.storyboardc/2-view-3.nib

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

Payload/XAgent.app/en.lproj/MainStoryboard.storyboardc/Info.plist

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

Payload/XAgent.app/en.lproj/MainStoryboard.storyboardc/UIViewController-2.nib

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Report Analysis Logs

General

Target

Payload/XAgent.app/XAgent
Size

280KB
MD5

6aea849846dd9f613970d0ea370e8a68
SHA1

4b8f42678064666965936048430afdb15a51a82b
SHA256

af30f7297d222453aa2a582dbc7dd9fdc6295cfe32d54228d461148684794a2a
SHA512

f6e4931895bb0d07b23ccfc907e36dddc6ce1d723d887f4ca7f6d47c8aacb929b967ae1a72fde73b9410f0205ab0768b2adaecac37f5f1a795e6b8929ee2a479
SSDEEP

6144:440R5uzXIgntP2miGQBDh4CsP3kYyuouGk:440zaXIutP2/Dh4mY

Score

1^/10

Malware Config

Signatures

Processes

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/XAgent.app/XAgent\""
1⤵
PID:489

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/XAgent.app/XAgent\""
1⤵
PID:489

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/XAgent.app/XAgent\""
1⤵
PID:489

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Payload/XAgent.app/XAgent
1⤵
PID:489

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Payload/XAgent.app/XAgent
1⤵
PID:489
- /bin/zsh
  /bin/zsh -c /Users/run/Payload/XAgent.app/XAgent
  2⤵
  PID:492
- /bin/zsh
  /bin/zsh -c /Users/run/Payload/XAgent.app/XAgent
  2⤵
  PID:492
- /Users/run/Payload/XAgent.app/XAgent
  /Users/run/Payload/XAgent.app/XAgent
  2⤵
  PID:492
- /Users/run/Payload/XAgent.app/XAgent
  /Users/run/Payload/XAgent.app/XAgent
  2⤵
  PID:492

/usr/sbin/spctl
/usr/sbin/spctl --status
1⤵
PID:490

/usr/sbin/spctl
/usr/sbin/spctl --test-devid-status
1⤵
PID:493

/usr/bin/syslog
/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
1⤵
PID:494

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:518

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:518

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2025

Terms | Privacy