Resubmissions
03-11-2023 14:59
231103-scqn6afe27 102-11-2023 19:33
231102-x9hr2aed2z 102-11-2023 19:29
231102-x7mcfaec8z 102-11-2023 19:28
231102-x6t1wsec7y 102-11-2023 19:27
231102-x6crlsec6x 302-11-2023 17:49
231102-wd3xnadd2z 102-11-2023 17:47
231102-wc6l6adc9x 102-11-2023 17:13
231102-vrh9qscg71 102-11-2023 15:35
231102-s1teysga64 102-11-2023 15:29
231102-sxbqqsfh62 1Analysis
-
max time kernel
18s -
max time network
32s -
platform
macos_amd64 -
resource
macos-20220504-en -
resource tags
arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
05-05-2023 01:47
Static task
static1
Behavioral task
behavioral1
Sample
download - 2023-05-02T122403.690.jpg
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
download - 2023-05-02T122403.690.jpg
Resource
macos-20220504-en
General
-
Target
download - 2023-05-02T122403.690.jpg
-
Size
8KB
-
MD5
dffa55f5e8bbd052dd4d0c371b69c3e3
-
SHA1
8298da424a8f9d9ee9f4957caddee146ea4c7f45
-
SHA256
1af9c152e70466c1e5c501808e2f836bc6f1121567d8493ca95f4ed2de7aeb95
-
SHA512
0da149201a925919336163d387157a00cbe2992cc6685b4b6731c89893234992661033e0e627890a9d7b755bef931e4e0233100a98ae13903f2128066d22a7b8
-
SSDEEP
192:luNs2r9h88h6Bnilz/ApE8xcbBNA+acabmInqhaqoZusQaIrRUiauXe9:4NBdh6N6/ApzxcLAjfqboZnIBzM
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/download - 2023-05-02T122403.690.jpg\""1⤵PID:506
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/download - 2023-05-02T122403.690.jpg\""1⤵PID:506
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/download - 2023-05-02T122403.690.jpg\""1⤵PID:506
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/download - 2023-05-02T122403.690.jpg"1⤵PID:506
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/download - 2023-05-02T122403.690.jpg"1⤵PID:506
-
/bin/zsh/bin/zsh -c "/Users/run/download - 2023-05-02T122403.690.jpg"2⤵PID:516
-
-
/bin/zsh/bin/zsh -c "/Users/run/download - 2023-05-02T122403.690.jpg"2⤵PID:516
-
-
/Users/run/download/Users/run/download - 2023-05-02T122403.690.jpg2⤵PID:516
-
-
/Users/run/download/Users/run/download - 2023-05-02T122403.690.jpg2⤵PID:516
-
-
/usr/sbin/spctl/usr/sbin/spctl --status1⤵PID:507
-
/usr/sbin/spctl/usr/sbin/spctl --test-devid-status1⤵PID:517
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵PID:518