Overview
overview
7Static
static
3Unconfirme...38.exe
windows7-x64
7Unconfirme...38.exe
windows10-1703-x64
7Unconfirme...38.exe
windows10-2004-x64
7Unconfirme...38.exe
android-10-x64
Unconfirme...38.exe
android-11-x64
Unconfirme...38.exe
android-9-x86
Unconfirme...38.exe
macos-10.15-amd64
1Unconfirme...38.exe
debian-9-armhf
Unconfirme...38.exe
debian-9-mips
Unconfirme...38.exe
debian-9-mipsel
Unconfirme...38.exe
ubuntu-18.04-amd64
Resubmissions
12-07-2023 05:22
230712-f2njwada21 712-07-2023 04:02
230712-el7r5sbg88 712-07-2023 03:30
230712-d2td1sbg25 712-07-2023 03:15
230712-drv5vsbf99 812-07-2023 02:56
230712-dfbl3sbf83 712-07-2023 02:45
230712-c88lvacg3w 712-07-2023 01:31
230712-bxezqabe33 712-07-2023 00:40
230712-a1lq1abc98 712-07-2023 00:18
230712-al175scd3x 712-07-2023 00:15
230712-aj3yysbc44 7Analysis
-
max time kernel
1259s -
max time network
1662s -
platform
macos_amd64 -
resource
macos-20220504-en -
resource tags
arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
12-07-2023 03:30
Static task
static1
Behavioral task
behavioral1
Sample
Unconfirmed 278138.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
Unconfirmed 278138.exe
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
Unconfirmed 278138.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
Unconfirmed 278138.exe
Resource
android-x64-20230621-en
Behavioral task
behavioral5
Sample
Unconfirmed 278138.exe
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral6
Sample
Unconfirmed 278138.exe
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral7
Sample
Unconfirmed 278138.exe
Resource
macos-20220504-en
Behavioral task
behavioral8
Sample
Unconfirmed 278138.exe
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral9
Sample
Unconfirmed 278138.exe
Resource
debian9-mipsbe-20221111-en
Behavioral task
behavioral10
Sample
Unconfirmed 278138.exe
Resource
debian9-mipsel-20221125-en
Behavioral task
behavioral11
Sample
Unconfirmed 278138.exe
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
Unconfirmed 278138.exe
-
Size
1.6MB
-
MD5
085c248832ef03881059faec18eae7ff
-
SHA1
8477892aadc283f5d000b2c36e4c44c370f59727
-
SHA256
d755331262471b1c5fb7c47ad5e0e5129f8c103f3e5df06120b3f8db61c31aae
-
SHA512
80d3327168c4597554f441cf29360d9ae982bd36afa7e6409c6e2b779eddc7a522f2bdcd190a82517fb445bf7714377f30a79c2cedea168f19139d82cc94c43f
-
SSDEEP
24576:u4nXubIQGyxbPV0db26ifZbRQKiFDhbGh3+shiy/wxwWIFgi5LPxf0XE:uqe3f60oKil5QhiyPbFT9eE
Malware Config
Signatures
Processes
-
/usr/sbin/spctl/usr/sbin/spctl --status1⤵PID:495
-
/usr/sbin/spctl/usr/sbin/spctl --test-devid-status1⤵PID:497
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Unconfirmed 278138.exe\""1⤵PID:498
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵PID:499
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Unconfirmed 278138.exe\""1⤵PID:498
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Unconfirmed 278138.exe\""1⤵PID:498
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Unconfirmed 278138.exe"1⤵PID:498
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Unconfirmed 278138.exe"1⤵PID:498
-
/bin/zsh/bin/zsh -c "/Users/run/Unconfirmed 278138.exe"2⤵PID:513
-
/bin/zsh/bin/zsh -c "/Users/run/Unconfirmed 278138.exe"2⤵PID:513
-
/Users/run/Unconfirmed/Users/run/Unconfirmed 278138.exe2⤵PID:513
-
/Users/run/Unconfirmed/Users/run/Unconfirmed 278138.exe2⤵PID:513
-
/usr/libexec/xpcproxyxpcproxy com.apple.bsd.dirhelper1⤵PID:541
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵PID:563
-
/usr/sbin/spindump/usr/sbin/spindump1⤵PID:563
-
/usr/libexec/xpcproxyxpcproxy com.apple.diagnosticd1⤵PID:564
-
/usr/libexec/diagnosticd/usr/libexec/diagnosticd1⤵PID:564
-
/usr/libexec/xpcproxyxpcproxy com.apple.gkreport1⤵PID:565
-
/usr/libexec/gkreport/usr/libexec/gkreport1⤵PID:565
-
/usr/sbin/spctl/usr/sbin/spctl --status2⤵PID:566
-
/usr/sbin/spctl/usr/sbin/spctl --test-devid-status2⤵PID:567
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"2⤵PID:568