Resubmissions

29-12-2023 16:37

231229-t4vmvseccm 1

29-12-2023 16:36

231229-t4n53shfa7 1

29-12-2023 16:30

231229-tz8zpahfa3 10

07-12-2022 15:20

221207-sq511afc38 10

11-03-2022 16:29

220311-tzk8madceq 10

11-03-2022 16:29

220311-tzg6zaacb6 1

04-06-2021 11:31

210604-wjcgrmw7fe 10

03-06-2021 17:10

210603-ha3r6tyzpj 10

03-06-2021 16:17

210603-j3xhhrl8fe 10

Analysis

  • max time kernel
    53s
  • max time network
    134s
  • platform
    macos-10.15_amd64
  • resource
    macos-20231201-en
  • resource tags

    arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    29-12-2023 16:30

General

  • Target

    filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib

  • Size

    100KB

  • MD5

    413d381ce461b9378dd3f85c4da16e4f

  • SHA1

    1cae3e3060ce8ca97f02008d2f9ead3e8d686835

  • SHA256

    f5f852b747fe14e6c70446600b623c826a0067f3e533c7768e3b9f6b0630531a

  • SHA512

    060388d2e458ed491f44293e56cb16c0f56672364ffabc843927a79d097ec5de08fd1ef260cb0f36b3629d4a3cc7bca7eda73cdfdf74f3f80fb416b1433bcc74

  • SSDEEP

    768:a/re/GnHHWr/uqIasquCuBIfqgr0Kin0a3DgfEwCYIftw4TdFI7oN/DyksE2:IelFsJIiC0Ki0a3EZcooFyko

Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib\""
    1⤵
      PID:513
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib\""
      1⤵
        PID:513
      • /bin/bash
        sh -c "sudo /bin/zsh -c \"/Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib\""
        1⤵
          PID:513
        • /usr/bin/sudo
          sudo /bin/zsh -c /Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib
          1⤵
            PID:513
          • /usr/bin/sudo
            sudo /bin/zsh -c /Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib
            1⤵
              PID:513
              • /bin/zsh
                /bin/zsh -c /Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib
                2⤵
                  PID:514
                • /bin/zsh
                  /bin/zsh -c /Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib
                  2⤵
                    PID:514
                  • /Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib
                    /Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib
                    2⤵
                      PID:514
                    • /Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib
                      /Users/run/filecoder/filecoder.app/Contents/Frameworks/libswiftCoreData.dylib
                      2⤵
                        PID:514
                    • /usr/sbin/spctl
                      /usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
                      1⤵
                        PID:556

                      Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads