Resubmissions
12-07-2023 05:22
230712-f2njwada21 712-07-2023 04:02
230712-el7r5sbg88 712-07-2023 03:30
230712-d2td1sbg25 712-07-2023 03:15
230712-drv5vsbf99 812-07-2023 02:56
230712-dfbl3sbf83 712-07-2023 02:45
230712-c88lvacg3w 712-07-2023 01:31
230712-bxezqabe33 712-07-2023 00:40
230712-a1lq1abc98 712-07-2023 00:18
230712-al175scd3x 712-07-2023 00:15
230712-aj3yysbc44 7Analysis
-
max time kernel
1200s -
max time network
1799s -
platform
macos_amd64 -
resource
macos-20220504-en -
resource tags
arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
12-07-2023 03:15
Static task
static1
Behavioral task
behavioral1
Sample
Unconfirmed 278138.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
Unconfirmed 278138.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Unconfirmed 278138.exe
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral4
Sample
Unconfirmed 278138.exe
Resource
android-x64-20230621-en
Behavioral task
behavioral5
Sample
Unconfirmed 278138.exe
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral6
Sample
Unconfirmed 278138.exe
Resource
macos-20220504-en
Behavioral task
behavioral7
Sample
Unconfirmed 278138.exe
Resource
debian9-armhf-en-20211208
General
-
Target
Unconfirmed 278138.exe
-
Size
1.6MB
-
MD5
085c248832ef03881059faec18eae7ff
-
SHA1
8477892aadc283f5d000b2c36e4c44c370f59727
-
SHA256
d755331262471b1c5fb7c47ad5e0e5129f8c103f3e5df06120b3f8db61c31aae
-
SHA512
80d3327168c4597554f441cf29360d9ae982bd36afa7e6409c6e2b779eddc7a522f2bdcd190a82517fb445bf7714377f30a79c2cedea168f19139d82cc94c43f
-
SSDEEP
24576:u4nXubIQGyxbPV0db26ifZbRQKiFDhbGh3+shiy/wxwWIFgi5LPxf0XE:uqe3f60oKil5QhiyPbFT9eE
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Unconfirmed 278138.exe\""1⤵PID:506
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Unconfirmed 278138.exe\""1⤵PID:506
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Unconfirmed 278138.exe\""1⤵PID:506
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Unconfirmed 278138.exe"1⤵PID:506
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Unconfirmed 278138.exe"1⤵PID:506
-
/bin/zsh/bin/zsh -c "/Users/run/Unconfirmed 278138.exe"2⤵PID:513
-
/bin/zsh/bin/zsh -c "/Users/run/Unconfirmed 278138.exe"2⤵PID:513
-
/Users/run/Unconfirmed/Users/run/Unconfirmed 278138.exe2⤵PID:513
-
/Users/run/Unconfirmed/Users/run/Unconfirmed 278138.exe2⤵PID:513
-
/usr/sbin/spctl/usr/sbin/spctl --test-devid-status1⤵PID:514
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵PID:515
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵PID:548
-
/usr/sbin/spindump/usr/sbin/spindump1⤵PID:548
-
/usr/libexec/xpcproxyxpcproxy com.apple.diagnosticd1⤵PID:549
-
/usr/libexec/diagnosticd/usr/libexec/diagnosticd1⤵PID:549
-
/usr/libexec/xpcproxyxpcproxy com.apple.newsyslog1⤵PID:551
-
/usr/sbin/newsyslog/usr/sbin/newsyslog1⤵PID:551
-
/usr/libexec/xpcproxyxpcproxy com.apple.bsd.dirhelper1⤵PID:553