Overview

overview

10

Static

static

10

7edead4770...c3c348

macos-10.15-amd64

10

Analysis

  • max time kernel
    202s
  • max time network
    211s
  • platform
    macos_amd64
  • resource
    macos-20220504-en
  • resource tags

    arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    16-07-2023 03:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7edead477048b47d2ac3abdc4baef12579c3c348

  • Size

    124KB

  • MD5

    a17bf4533d7ec677a0d4bdae19e41ff2

  • SHA1

    7edead477048b47d2ac3abdc4baef12579c3c348

  • SHA256

    97d6b194da410db82d9974aec984cff8ac0a6ad59ec72b79d4b2a4672b5aa8aa

  • SHA512

    7eb633c3bf9a96629f7e110bc446dc3ec74d4e247818b36ba61f5c630cfbfdce83b9decae085c2a984c58e0f5210a1ce74bd21111b0ffd7724b0d33e96c0c99c

  • SSDEEP

    3072:Q8+OzCmILFHKLDWykiGmGtIm5NtrUQhPgOGGO:QBE/ILRxyn8O8NtrUU

Score
10/10
xloaderloaderrat

Malware Config

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader payload 3 IoCs
    rat

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/7edead477048b47d2ac3abdc4baef12579c3c348\""
    1⤵
      PID:489
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/7edead477048b47d2ac3abdc4baef12579c3c348\""
      1⤵
        PID:489
      • /bin/bash
        sh -c "sudo /bin/zsh -c \"/Users/run/7edead477048b47d2ac3abdc4baef12579c3c348\""
        1⤵
          PID:489
        • /usr/sbin/spctl
          /usr/sbin/spctl --status
          1⤵
            PID:488
          • /usr/bin/sudo
            sudo /bin/zsh -c /Users/run/7edead477048b47d2ac3abdc4baef12579c3c348
            1⤵
              PID:489
            • /usr/bin/sudo
              sudo /bin/zsh -c /Users/run/7edead477048b47d2ac3abdc4baef12579c3c348
              1⤵
                PID:489
                • /bin/zsh
                  /bin/zsh -c /Users/run/7edead477048b47d2ac3abdc4baef12579c3c348
                  2⤵
                    PID:502
                  • /bin/zsh
                    /bin/zsh -c /Users/run/7edead477048b47d2ac3abdc4baef12579c3c348
                    2⤵
                      PID:502
                    • /Users/run/7edead477048b47d2ac3abdc4baef12579c3c348
                      /Users/run/7edead477048b47d2ac3abdc4baef12579c3c348
                      2⤵
                        PID:502
                      • /Users/run/7edead477048b47d2ac3abdc4baef12579c3c348
                        /Users/run/7edead477048b47d2ac3abdc4baef12579c3c348
                        2⤵
                          PID:502
                      • /usr/sbin/spctl
                        /usr/sbin/spctl --test-devid-status
                        1⤵
                          PID:501
                        • /bin/sh
                          sh -c /var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                          1⤵
                            PID:503
                          • /bin/bash
                            sh -c /var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                            1⤵
                              PID:503
                            • /bin/bash
                              sh -c /var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                              1⤵
                                PID:503
                              • /var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                                /var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                                1⤵
                                  PID:503
                                • /var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                                  /var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                                  1⤵
                                    PID:503
                                  • /usr/bin/syslog
                                    /usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
                                    1⤵
                                      PID:504
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.tailspind
                                      1⤵
                                        PID:518
                                      • /usr/libexec/tailspind
                                        /usr/libexec/tailspind
                                        1⤵
                                          PID:518
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.gkreport
                                          1⤵
                                            PID:536
                                          • /usr/libexec/gkreport
                                            /usr/libexec/gkreport
                                            1⤵
                                              PID:536
                                              • /usr/sbin/spctl
                                                /usr/sbin/spctl --status
                                                2⤵
                                                  PID:537
                                                • /usr/sbin/spctl
                                                  /usr/sbin/spctl --test-devid-status
                                                  2⤵
                                                    PID:538
                                                  • /usr/bin/syslog
                                                    /usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
                                                    2⤵
                                                      PID:539
                                                  • /bin/sh
                                                    sh -c "security find-generic-password -wa 'Chrome'"
                                                    1⤵
                                                      PID:540
                                                    • /bin/bash
                                                      sh -c "security find-generic-password -wa 'Chrome'"
                                                      1⤵
                                                        PID:540
                                                      • /bin/bash
                                                        sh -c "security find-generic-password -wa 'Chrome'"
                                                        1⤵
                                                          PID:540
                                                        • /usr/bin/security
                                                          security find-generic-password -wa Chrome
                                                          1⤵
                                                            PID:540
                                                          • /usr/bin/security
                                                            security find-generic-password -wa Chrome
                                                            1⤵
                                                              PID:540
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.security.agent
                                                              1⤵
                                                                PID:541
                                                              • /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
                                                                /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
                                                                1⤵
                                                                  PID:541

                                                                Network

                                                                MITRE ATT&CK Matrix

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • /private/var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/Info.plist
                                                                  Filesize

                                                                  783B

                                                                  MD5

                                                                  c6c7e7daa145a99afed60ca1cc359e97

                                                                  SHA1

                                                                  00aa93c62e72da76408850d242015f71e95cdf96

                                                                  SHA256

                                                                  a070fc8a998c6aa52bc2258b32f4241f8d9a3e22f03fe730179292c8cc38f2f7

                                                                  SHA512

                                                                  76942411ddbf7b53cbd525218facec6aae5213225215b838ec5c2a72ff61fd127b2dc4416fc3b38d2eff27f1f00315dbc4a580786d2e91113f766a4a79c67e74

                                                                  Download Submit
                                                                • /private/var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/Info.plist
                                                                  Filesize

                                                                  783B

                                                                  MD5

                                                                  c6c7e7daa145a99afed60ca1cc359e97

                                                                  SHA1

                                                                  00aa93c62e72da76408850d242015f71e95cdf96

                                                                  SHA256

                                                                  a070fc8a998c6aa52bc2258b32f4241f8d9a3e22f03fe730179292c8cc38f2f7

                                                                  SHA512

                                                                  76942411ddbf7b53cbd525218facec6aae5213225215b838ec5c2a72ff61fd127b2dc4416fc3b38d2eff27f1f00315dbc4a580786d2e91113f766a4a79c67e74

                                                                  Download Submit
                                                                • /private/var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/Info.plist
                                                                  Filesize

                                                                  783B

                                                                  MD5

                                                                  c6c7e7daa145a99afed60ca1cc359e97

                                                                  SHA1

                                                                  00aa93c62e72da76408850d242015f71e95cdf96

                                                                  SHA256

                                                                  a070fc8a998c6aa52bc2258b32f4241f8d9a3e22f03fe730179292c8cc38f2f7

                                                                  SHA512

                                                                  76942411ddbf7b53cbd525218facec6aae5213225215b838ec5c2a72ff61fd127b2dc4416fc3b38d2eff27f1f00315dbc4a580786d2e91113f766a4a79c67e74

                                                                  Download Submit
                                                                • /private/var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                                                                  Filesize

                                                                  124KB

                                                                  MD5

                                                                  a17bf4533d7ec677a0d4bdae19e41ff2

                                                                  SHA1

                                                                  7edead477048b47d2ac3abdc4baef12579c3c348

                                                                  SHA256

                                                                  97d6b194da410db82d9974aec984cff8ac0a6ad59ec72b79d4b2a4672b5aa8aa

                                                                  SHA512

                                                                  7eb633c3bf9a96629f7e110bc446dc3ec74d4e247818b36ba61f5c630cfbfdce83b9decae085c2a984c58e0f5210a1ce74bd21111b0ffd7724b0d33e96c0c99c

                                                                  Download Submit
                                                                • /private/var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                                                                  Filesize

                                                                  124KB

                                                                  MD5

                                                                  a17bf4533d7ec677a0d4bdae19e41ff2

                                                                  SHA1

                                                                  7edead477048b47d2ac3abdc4baef12579c3c348

                                                                  SHA256

                                                                  97d6b194da410db82d9974aec984cff8ac0a6ad59ec72b79d4b2a4672b5aa8aa

                                                                  SHA512

                                                                  7eb633c3bf9a96629f7e110bc446dc3ec74d4e247818b36ba61f5c630cfbfdce83b9decae085c2a984c58e0f5210a1ce74bd21111b0ffd7724b0d33e96c0c99c

                                                                  Download Submit
                                                                • /private/var/root/.gFehd4BhchMx/Tn8d0l.app/Contents/MacOS/Tn8d0l
                                                                  Filesize

                                                                  124KB

                                                                  MD5

                                                                  a17bf4533d7ec677a0d4bdae19e41ff2

                                                                  SHA1

                                                                  7edead477048b47d2ac3abdc4baef12579c3c348

                                                                  SHA256

                                                                  97d6b194da410db82d9974aec984cff8ac0a6ad59ec72b79d4b2a4672b5aa8aa

                                                                  SHA512

                                                                  7eb633c3bf9a96629f7e110bc446dc3ec74d4e247818b36ba61f5c630cfbfdce83b9decae085c2a984c58e0f5210a1ce74bd21111b0ffd7724b0d33e96c0c99c

                                                                  Download Submit