Overview

overview

1

Static

static

1

License.command

macos-10.15-amd64

1

Resubmissions

27/08/2023, 19:29

230827-x6924scg89 1

27/08/2023, 19:28

230827-x639kacg87 1

Analysis

  • max time kernel
    17s
  • max time network
    22s
  • platform
    macos_amd64
  • resource
    macos-20220504-en
  • resource tags

    arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    27/08/2023, 19:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    License.command

  • Size

    462B

  • MD5

    6f22391b847748142643f916b949540f

  • SHA1

    c84b1e6efe7900b3c07009f4e719970e01eb19e3

  • SHA256

    838a59b8c49cc5843758f0b45073ac4082b2e5a923da1db1f3e6cee3895685f2

  • SHA512

    07a31c48ed2f6767fbc177bb0be399ea36820775d18b31b320b9c880ca5ff0744d69919fd4d701ac055503b5323a63aad19d48d7e43f11b922da2bc0c7fb4fff

Score
1/10

Malware Config

Signatures

Processes

  • /usr/sbin/spctl
    /usr/sbin/spctl --status
    1⤵
      PID:492
    • /bin/sh
      sh -c "sudo /bin/zsh -c \"/Users/run/License.command\""
      1⤵
        PID:493
      • /bin/bash
        sh -c "sudo /bin/zsh -c \"/Users/run/License.command\""
        1⤵
          PID:493
        • /bin/bash
          sh -c "sudo /bin/zsh -c \"/Users/run/License.command\""
          1⤵
            PID:493
          • /usr/sbin/spctl
            /usr/sbin/spctl --test-devid-status
            1⤵
              PID:495
            • /usr/bin/sudo
              sudo /bin/zsh -c /Users/run/License.command
              1⤵
                PID:493
              • /usr/bin/sudo
                sudo /bin/zsh -c /Users/run/License.command
                1⤵
                  PID:493
                  • /bin/zsh
                    /bin/zsh -c /Users/run/License.command
                    2⤵
                      PID:510
                    • /bin/zsh
                      /bin/zsh -c /Users/run/License.command
                      2⤵
                        PID:510
                      • /Users/run/License.command
                        /Users/run/License.command
                        2⤵
                          PID:510
                        • /Users/run/License.command
                          /Users/run/License.command
                          2⤵
                            PID:510
                          • /bin/sh
                            sh /Users/run/License.command
                            2⤵
                              PID:510
                            • /bin/sh
                              sh /Users/run/License.command
                              2⤵
                                PID:510
                              • /bin/bash
                                sh /Users/run/License.command
                                2⤵
                                  PID:510
                                • /bin/bash
                                  sh /Users/run/License.command
                                  2⤵
                                    PID:510
                                    • /usr/bin/killall
                                      killall AlDente
                                      3⤵
                                        PID:511
                                      • /usr/bin/killall
                                        killall AlDente
                                        3⤵
                                          PID:511
                                        • /bin/mkdir
                                          mkdir "/Users/run/Library/Application Support/AlDente"
                                          3⤵
                                            PID:519
                                          • /bin/mkdir
                                            mkdir "/Users/run/Library/Application Support/AlDente"
                                            3⤵
                                              PID:519
                                            • /usr/bin/dirname
                                              dirname /Users/run/License.command
                                              3⤵
                                                PID:520
                                              • /usr/bin/dirname
                                                dirname /Users/run/License.command
                                                3⤵
                                                  PID:520
                                                • /bin/cp
                                                  cp -R AlDente "/Users/run/Library/Application Support/"
                                                  3⤵
                                                    PID:521
                                                  • /bin/cp
                                                    cp -R AlDente "/Users/run/Library/Application Support/"
                                                    3⤵
                                                      PID:521
                                                    • /usr/bin/osascript
                                                      osascript
                                                      3⤵
                                                        PID:522
                                                      • /usr/bin/osascript
                                                        osascript
                                                        3⤵
                                                          PID:522
                                                    • /usr/bin/syslog
                                                      /usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
                                                      1⤵
                                                        PID:496
                                                      • /usr/libexec/xpcproxy
                                                        xpcproxy com.apple.systemevents.1332
                                                        1⤵
                                                          PID:523
                                                        • /System/Library/CoreServices/System Events.app/Contents/MacOS/System Events
                                                          "/System/Library/CoreServices/System Events.app/Contents/MacOS/System Events"
                                                          1⤵
                                                            PID:523
                                                          • /usr/libexec/xpcproxy
                                                            xpcproxy com.apple.FolderActionsDispatcher
                                                            1⤵
                                                              PID:526
                                                            • /System/Library/CoreServices/FolderActionsDispatcher.app/Contents/MacOS/FolderActionsDispatcher
                                                              /System/Library/CoreServices/FolderActionsDispatcher.app/Contents/MacOS/FolderActionsDispatcher launchd
                                                              1⤵
                                                                PID:526
                                                              • /usr/libexec/xpcproxy
                                                                xpcproxy com.apple.ReportMemoryException
                                                                1⤵
                                                                  PID:530
                                                                • /usr/libexec/ReportMemoryException
                                                                  /usr/libexec/ReportMemoryException
                                                                  1⤵
                                                                    PID:530

                                                                  Network

                                                                        MITRE ATT&CK Matrix

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • /private/var/tmp/sh-thd-1693217464
                                                                          Filesize

                                                                          279B

                                                                          MD5

                                                                          9070d5584a5ba4443b89b488ed65e279

                                                                          SHA1

                                                                          692e3f23ffa2053a5faf67d88ba21fd8b479521b

                                                                          SHA256

                                                                          4203a1e1d1a7217356ded6dfa7fa35e79b813eab0692ad29170f53432ec1162b

                                                                          SHA512

                                                                          60e6e834f353eb8184aefadcee7101b9ea17f015fd2be502c7e135d34fcc79f03a4155d96f886fee0fd627e3fccf158f507ac5d7a84f18c9391d67640e8793f1

                                                                          Download Submit

                                                                        • /private/var/tmp/sh-thd-1693217464
                                                                          Filesize

                                                                          279B

                                                                          MD5

                                                                          9070d5584a5ba4443b89b488ed65e279

                                                                          SHA1

                                                                          692e3f23ffa2053a5faf67d88ba21fd8b479521b

                                                                          SHA256

                                                                          4203a1e1d1a7217356ded6dfa7fa35e79b813eab0692ad29170f53432ec1162b

                                                                          SHA512

                                                                          60e6e834f353eb8184aefadcee7101b9ea17f015fd2be502c7e135d34fcc79f03a4155d96f886fee0fd627e3fccf158f507ac5d7a84f18c9391d67640e8793f1

                                                                          Download Submit