f8b29648ab7534c535201c44a71f77225e87d874685c6495c1b6247dbbbd1257 | Triage

Analysis

max time kernel
10s
max time network
19s
platform
macos_amd64
resource
macos-20220504-en
resource tags

arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
19/11/2023, 22:43

Sharing

Report Analysis Logs

General

Target

Nitro+8x+[v1.01]+by+Fryne.zip
Size

2.0MB
MD5

9588871d00db21406ba8d05385af7987
SHA1

05d254a5bf55ed7ebe9b2248ef6464dd79ce8023
SHA256

f8b29648ab7534c535201c44a71f77225e87d874685c6495c1b6247dbbbd1257
SHA512

3139e7b556774a6f99980825fb2d9bd2561d6240bacdd003ba10ee5e3f4f4a8b76de962b2fdd7348d094fa5e47120c696399aa2ea07538ff1251929ee1e5e5f8
SSDEEP

49152:KUBJiDuX62bQMYeGIJ+ZJo20ZEETYaZoK:KUGaX6O9wZJ5ExZoK

Score

1^/10

Malware Config

Signatures

/usr/sbin/spctl
/usr/sbin/spctl --status
1⤵
PID:489

/usr/sbin/spctl
/usr/sbin/spctl --test-devid-status
1⤵
PID:490

/usr/bin/syslog
/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
1⤵
PID:492

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Nitro+8x+[v1.01]+by+Fryne.zip\""
1⤵
PID:491

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Nitro+8x+[v1.01]+by+Fryne.zip\""
1⤵
PID:491

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Nitro+8x+[v1.01]+by+Fryne.zip\""
1⤵
PID:491

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Nitro+8x+[v1.01]+by+Fryne.zip"
1⤵
PID:491

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Nitro+8x+[v1.01]+by+Fryne.zip"
1⤵
PID:491
- /bin/zsh
  /bin/zsh -c "/Users/run/Nitro+8x+[v1.01]+by+Fryne.zip"
  2⤵
  PID:514
- /bin/zsh
  /bin/zsh -c "/Users/run/Nitro+8x+[v1.01]+by+Fryne.zip"
  2⤵
  PID:514

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads