47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8

Resubmissions

31/03/2023, 17:49

230331-wegqtade5v1

31/03/2023, 17:46

230331-wctbtsde311

31/03/2023, 17:45

230331-wb591ade3w1

31/03/2023, 17:24

230331-vyn4kadc8y10

Analysis

max time kernel
65s
max time network
74s
platform
macos_amd64
resource
macos-20220504-en
resource tags

arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
31/03/2023, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NoEscape.zip
Size 616KB
Sample230331-wegqtade5v
SHA256 47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8
MD5 ef4fdf65fc90bfda8d1d2ae6d20aff60
SHA1 9431227836440c78f12bfb2cb3247d59f4d4640b
SHA512 6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9
SSDEEP 12288:1PQuO1JLx2auoA82iqOxdOc7XPkmpOw6mqc5m937hnTMktj1H:1PVqJx2auYqw7dOw6mql3nNBd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/NoEscape.zip\""
1⤵
PID:495

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/NoEscape.zip\""
1⤵
PID:495

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/NoEscape.zip\""
1⤵
PID:495

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/NoEscape.zip
1⤵
PID:495

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/NoEscape.zip
1⤵
PID:495
- /bin/zsh
  /bin/zsh -c /Users/run/NoEscape.zip
  2⤵
  PID:511
- /bin/zsh
  /bin/zsh -c /Users/run/NoEscape.zip
  2⤵
  PID:511
- /Users/run/NoEscape.zip
  /Users/run/NoEscape.zip
  2⤵
  PID:511
- /Users/run/NoEscape.zip
  /Users/run/NoEscape.zip
  2⤵
  PID:511

/usr/sbin/spctl
/usr/sbin/spctl --status
1⤵
PID:496

/usr/sbin/spctl
/usr/sbin/spctl --test-devid-status
1⤵
PID:515

/usr/bin/syslog
/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:526

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:534

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:532

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:534

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:529

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:533

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 527
1⤵
PID:540

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:540

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads