Analysis
-
max time kernel
81s -
max time network
75s -
platform
macos_amd64 -
resource
macos-20220504-en -
resource tags
arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
31-03-2023 20:02
Static task
static1
Behavioral task
behavioral1
Sample
test.py
Resource
macos-20220504-en
General
-
Target
test.py
-
Size
597B
-
MD5
0af665d88fab8f193cee710ec3184941
-
SHA1
fa22d06c81ec69fc5a1896a620e5424dc1e1e873
-
SHA256
479c4414d2faf51497494f871a09081d944f5221031ace26f7fbd9a609259bb7
-
SHA512
b1fc5f72d0384bff9d4d815741a1ee8b42a1ea92697e2c86116f04f07b0ffb9595e2b59077d337d74503e3d4878f0bf699b051e038e15c10a17f0d486d5b7f28
Malware Config
Signatures
Processes
-
/usr/sbin/spctl/usr/sbin/spctl --status1⤵
-
/usr/sbin/spctl/usr/sbin/spctl --test-devid-status1⤵
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/test.py\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/test.py\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/test.py\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/test.py1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/test.py1⤵
-
/bin/zsh/bin/zsh -c /Users/run/test.py2⤵
-
/bin/zsh/bin/zsh -c /Users/run/test.py2⤵
-
/Users/run/test.py/Users/run/test.py2⤵
-
/Users/run/test.py/Users/run/test.py2⤵
-
/bin/shsh /Users/run/test.py2⤵
-
/bin/shsh /Users/run/test.py2⤵
-
/bin/bashsh /Users/run/test.py2⤵
-
/bin/bashsh /Users/run/test.py2⤵
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.PerformanceAnalysis.animationperfd1⤵
-
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.tailspind1⤵
-
/usr/libexec/tailspind/usr/libexec/tailspind1⤵
-
/usr/bin/loginlogin -pf run1⤵
-
/usr/bin/loginlogin -pf run1⤵
-
/bin/zsh-zsh2⤵
-
/bin/zsh-zsh2⤵
-
/usr/libexec/path_helper/usr/libexec/path_helper -s3⤵
-
/usr/libexec/path_helper/usr/libexec/path_helper -s3⤵
-
/usr/bin/localelocale LC_CTYPE3⤵
-
/usr/bin/localelocale LC_CTYPE3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/Users/run/.zsh_historyFilesize
533B
MD5587758925574511e125d04b6e7753bb3
SHA197d5dc3820e3942387bf4a6422496c2888b9120f
SHA2563f5b691cf31d199647886a97a0b3e1f3941eb9fe5bec7efc2c78ede57ee49d99
SHA512674e9288094d71e2fb43262fec0efe60ade6a84053f98732edffccb6712184fc1b24ba0307e9b50fdc2e1b4a5801e7bf271689090a57262685718a045ac10cb9
-
/Users/run/.zsh_historyFilesize
533B
MD5587758925574511e125d04b6e7753bb3
SHA197d5dc3820e3942387bf4a6422496c2888b9120f
SHA2563f5b691cf31d199647886a97a0b3e1f3941eb9fe5bec7efc2c78ede57ee49d99
SHA512674e9288094d71e2fb43262fec0efe60ade6a84053f98732edffccb6712184fc1b24ba0307e9b50fdc2e1b4a5801e7bf271689090a57262685718a045ac10cb9
-
/Users/run/.zsh_history.newFilesize
533B
MD5587758925574511e125d04b6e7753bb3
SHA197d5dc3820e3942387bf4a6422496c2888b9120f
SHA2563f5b691cf31d199647886a97a0b3e1f3941eb9fe5bec7efc2c78ede57ee49d99
SHA512674e9288094d71e2fb43262fec0efe60ade6a84053f98732edffccb6712184fc1b24ba0307e9b50fdc2e1b4a5801e7bf271689090a57262685718a045ac10cb9
-
/private/var/run/utmpxFilesize
3KB
MD5eb0ad89f2cef5ec27815ef3714a42e33
SHA18618f5c97109b339393f93e734cf1cdc12b507fb
SHA2560d120a89ce4e9c7593f2a65c37526ff9307e63ec1890518461b342c561eda363
SHA51271cde05a22010dd2065ea067ceba9b5857d66bd7fe8244ee31bb59f5d4c43625a2c65dc53703090507f717b626d9966d41d713de357d1649dc5eb5616cf50408
-
/private/var/run/utmpxFilesize
3KB
MD5eb0ad89f2cef5ec27815ef3714a42e33
SHA18618f5c97109b339393f93e734cf1cdc12b507fb
SHA2560d120a89ce4e9c7593f2a65c37526ff9307e63ec1890518461b342c561eda363
SHA51271cde05a22010dd2065ea067ceba9b5857d66bd7fe8244ee31bb59f5d4c43625a2c65dc53703090507f717b626d9966d41d713de357d1649dc5eb5616cf50408