Overview
overview
6Static
static
6Payload/ES...ts.pdf
windows7-x64
1Payload/ES...ts.pdf
windows10-2004-x64
1Payload/ES.../ESign
macos-10.15-amd64
1Payload/ES...x.html
windows7-x64
1Payload/ES...x.html
windows10-2004-x64
1Payload/ES...min.js
windows7-x64
1Payload/ES...min.js
windows10-2004-x64
1Payload/ES...min.js
windows7-x64
1Payload/ES...min.js
windows10-2004-x64
1Payload/ES...dex.js
windows7-x64
1Payload/ES...dex.js
windows10-2004-x64
1Payload/ES...oad.js
windows7-x64
1Payload/ES...oad.js
windows10-2004-x64
1Payload/ES...ort.js
windows7-x64
1Payload/ES...ort.js
windows10-2004-x64
1Payload/ES...ble.js
windows7-x64
1Payload/ES...ble.js
windows10-2004-x64
1Payload/ES...min.js
windows7-x64
1Payload/ES...min.js
windows10-2004-x64
1Payload/ES...get.js
windows7-x64
1Payload/ES...get.js
windows10-2004-x64
1Payload/ES...min.js
windows7-x64
1Payload/ES...min.js
windows10-2004-x64
1Payload/ES...min.js
windows7-x64
1Payload/ES...min.js
windows10-2004-x64
1Payload/ES...ts.pdf
windows7-x64
1Payload/ES...ts.pdf
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
137s -
platform
macos_amd64 -
resource
macos-20220504-en -
resource tags
arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
17-11-2023 02:13
Behavioral task
behavioral1
Sample
Payload/ESign.app/Assets.pdf
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Payload/ESign.app/Assets.pdf
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Payload/ESign.app/ESign
Resource
macos-20220504-en
Behavioral task
behavioral4
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/index.html
Resource
win7-20231020-en
Behavioral task
behavioral5
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/index.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral6
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/bootstrap.min.js
Resource
win7-20231023-en
Behavioral task
behavioral7
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/bootstrap.min.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral8
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/html5shiv.min.js
Resource
win7-20231020-en
Behavioral task
behavioral9
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/html5shiv.min.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral10
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/index.js
Resource
win7-20231023-en
Behavioral task
behavioral11
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/index.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral12
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.fileupload.js
Resource
win7-20231023-en
Behavioral task
behavioral13
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.fileupload.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.iframe-transport.js
Resource
win7-20231020-en
Behavioral task
behavioral15
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.iframe-transport.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral16
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.jeditable.js
Resource
win7-20231023-en
Behavioral task
behavioral17
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.jeditable.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral18
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.min.js
Resource
win7-20231025-en
Behavioral task
behavioral19
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.min.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral20
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.ui.widget.js
Resource
win7-20231023-en
Behavioral task
behavioral21
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/jquery.ui.widget.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral22
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/respond.min.js
Resource
win7-20231023-en
Behavioral task
behavioral23
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/respond.min.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral24
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/tmpl.min.js
Resource
win7-20231020-en
Behavioral task
behavioral25
Sample
Payload/ESign.app/GCDWebUploader.bundle/Contents/Resources/js/tmpl.min.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral26
Sample
Payload/ESign.app/QMUIResources.bundle/Assets.pdf
Resource
win7-20231025-en
Behavioral task
behavioral27
Sample
Payload/ESign.app/QMUIResources.bundle/Assets.pdf
Resource
win10v2004-20231020-en
General
-
Target
Payload/ESign.app/ESign
-
Size
14.1MB
-
MD5
ceef5794faaf0297f451b80293ab2e81
-
SHA1
883909263493fcc34b2c43359165d91037838919
-
SHA256
a101e2aea1a97765f04640176cca504b7023fe8ebb4774576e81d9f400de59b9
-
SHA512
3eb1c5a7fa1452a77872fb042b078f307017d8cae1f19747f71ea130a7a5fa7439132141bbf669295b2e2944aeab4d73f2d5b3f2874c4452a570ca5c13ce4907
-
SSDEEP
393216:cwQ1Dj28ttf9qYoK9d64kVbPyKQLTR7G2bQGPE0m3VbjCflssY3by1sb305Yb3Yx:cqKkLibQGPE0m3VbjCflssY3by1sb30T
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Payload/ESign.app/ESign\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Payload/ESign.app/ESign\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Payload/ESign.app/ESign\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Payload/ESign.app/ESign1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Payload/ESign.app/ESign1⤵
-
/bin/zsh/bin/zsh -c /Users/run/Payload/ESign.app/ESign2⤵
-
/bin/zsh/bin/zsh -c /Users/run/Payload/ESign.app/ESign2⤵
-
/Users/run/Payload/ESign.app/ESign/Users/run/Payload/ESign.app/ESign2⤵
-
/Users/run/Payload/ESign.app/ESign/Users/run/Payload/ESign.app/ESign2⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.tailspind1⤵
-
/usr/libexec/tailspind/usr/libexec/tailspind1⤵