Analysis
-
max time kernel
138s -
max time network
152s -
platform
macos-10.15_amd64 -
resource
macos-20231201-en -
resource tags
arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
31/12/2023, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
289e51ab86e77649e89f3a4674cbeaca
Resource
macos-20231201-en
General
-
Target
289e51ab86e77649e89f3a4674cbeaca
-
Size
428KB
-
MD5
289e51ab86e77649e89f3a4674cbeaca
-
SHA1
e9682590793c44c1ef20f455aa4f9aefe606e3d8
-
SHA256
b8658690d38a9bf87aecb039ba7d1799671e0608b7e9dbe48ff763b487dbef85
-
SHA512
821bcee2d98a5197ad0cfa5899b9f112e2572cdd58c9df1cabc2b18bd84dc0865c423373f3fb476b3a2a8ebbb91ec723b99163c58f32882d9114a40e70b99892
-
SSDEEP
6144:U4VpwGkcAP4jRwRzylRJnx9EWVDoeKO95ZTrEnkQvG/7b0PH6JErbMMNG0ijkBa:UEIcAP4jRPlRZEMB9H3EnkQv274PaX
Malware Config
Signatures
Processes
-
/usr/sbin/spctl/usr/sbin/spctl --test-devid-status1⤵PID:575
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵PID:576
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/289e51ab86e77649e89f3a4674cbeaca\""1⤵PID:577
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/289e51ab86e77649e89f3a4674cbeaca\""1⤵PID:577
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/289e51ab86e77649e89f3a4674cbeaca\""1⤵PID:577
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/289e51ab86e77649e89f3a4674cbeaca1⤵PID:577
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/289e51ab86e77649e89f3a4674cbeaca1⤵PID:577
-
/bin/zsh/bin/zsh -c /Users/run/289e51ab86e77649e89f3a4674cbeaca2⤵PID:578
-
-
/bin/zsh/bin/zsh -c /Users/run/289e51ab86e77649e89f3a4674cbeaca2⤵PID:578
-
-
/Users/run/289e51ab86e77649e89f3a4674cbeaca/Users/run/289e51ab86e77649e89f3a4674cbeaca2⤵PID:578
-
-
/Users/run/289e51ab86e77649e89f3a4674cbeaca/Users/run/289e51ab86e77649e89f3a4674cbeaca2⤵PID:578
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:599
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:599
-
/usr/libexec/xpcproxyxpcproxy com.apple.PerfPowerServices1⤵PID:602
-
/usr/libexec/PerfPowerServices/usr/libexec/PerfPowerServices1⤵PID:602
-
/usr/libexec/xpcproxyxpcproxy com.apple.icloud.findmydeviced1⤵PID:607
-
/usr/libexec/findmydeviced/usr/libexec/findmydeviced1⤵PID:607
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:614
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:614
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵PID:615
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵PID:615
-
/usr/libexec/xpcproxyxpcproxy com.apple.secinitd1⤵PID:616
-
/usr/libexec/secinitd/usr/libexec/secinitd1⤵PID:616
-
/usr/libexec/xpcproxyxpcproxy com.apple.cfprefsd.xpc.agent1⤵PID:618
-
/usr/sbin/cfprefsd/usr/sbin/cfprefsd agent1⤵PID:618
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵PID:622
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵PID:622
-
/usr/libexec/xpcproxyxpcproxy com.apple.suggestd1⤵PID:623
-
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd1⤵PID:623
-
/usr/libexec/xpcproxyxpcproxy com.apple.knowledge-agent1⤵PID:629
-
/usr/libexec/knowledge-agent/usr/libexec/knowledge-agent1⤵PID:629
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵PID:631
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵PID:631
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵PID:634
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵PID:634
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵PID:636
-
/usr/libexec/neagent/usr/libexec/neagent1⤵PID:636
-
/usr/libexec/xpcproxyxpcproxy com.apple.siri.context.service1⤵PID:639
-
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService1⤵PID:639
-
/usr/libexec/xpcproxyxpcproxy com.apple.tailspind1⤵PID:644
-
/usr/libexec/tailspind/usr/libexec/tailspind1⤵PID:644
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:660
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:660
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod 2)/Default_Shields-1671.iconconfigpack
Filesize82KB
MD59563a30bbd5d0af6f826ac7a6f33cf74
SHA1df5f46010618c73b1a2bf277b7ca2a0c6ee97e9c
SHA256d8ae99aedff70b2d0382f393dca972e58f26a866e9c831e6b0ec6717eaf89fda
SHA512f5bd911863ac95fe1fc89a951c2ffda27308bbb93e35c6ed9dbfb936370cae526e179af2a12417a41cab3a359cdc9f5fc48f735af77df12ef0e2acd28b69fe7d
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/ActiveTileGroup.pbd
Filesize124KB
MD5a0a69758c7b6080fbd0ac44354c446c7
SHA1f953056eb5d9896631c5b55d3640ff8287bd10ac
SHA2560c75f834a6a598bd3b8b82a86199340f30ff29c441cd1ff1f0b78fb4fac3da18
SHA5122d5a03d94a3d83b30a0b29d60e28dc9e741467127fe7d3413bf7c2083ce41f5983554e0df146c5288e81414c0a2bccf1318ecc91c32c2594270357732013c4a8
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/Default-18242.iconmappack
Filesize141KB
MD5b4c22a09fe2f31466efb161ecbe2b2c3
SHA1aeecd74130ef2f9799e5b0baa95cdb71d54ce6c9
SHA2564cf1086aee27b90f5b6e10f7dc7d3113845c1cb7efb844b4a0bb6990589607e2
SHA51264162fd751a35d4868c4e0b358c7a4c687078dc43ce6abe6d043aa9d70881ee8273a89bc9a0faef0453c68b63699b0a66aa5dcec7e3d13a34e3f50011c723006
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/[email protected]
Filesize141KB
MD545858a55c27b09a84895a274589742f8
SHA1401e5fb105d818eb631e294d25c33b978ae58a42
SHA256977f6a61e6caba111511db7a50f6a57ea094d644da3dc17669c02e6e5f780a8a
SHA5127613625b022da7a03c3a650b12c77aa1d6d2e9113a42a0350539465853f2966c5ebd9be57f90d4162e35f8987dbfbe43e7c86ec0d7beb209bbbd55f51f2471be
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/[email protected]
Filesize557KB
MD5c612eeafe7d65893269b9b39f64cc2da
SHA1b337aed83971aeccdf700982c3a3cb5aec92c1c5
SHA2568900950d05fb0f2db3032ea7849f48c7655f210e666aec31d1913b14089733c6
SHA5124c0c208d9ff3a12872d5c7e91819fe804b602e02bf822081fe975233f2c22b9a4776f309301487914945ab26536945a3659fccfccc5b2a01a453af63318132c6
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/ResourceManifest.pbd
Filesize248KB
MD5351d0f978b0277bad67dd61791167400
SHA1d0f7e70d8eea2ca7cda0ab2a05ecfca033d68bb3
SHA2561f5fbf3d5e5fb737132710fafb6c1b4c8a044be156ba759e49c1c5c14511a9cf
SHA5122fe12b83aef133fe4bc3ebd4565a30ed75c6c09de96520be87ce2b66585f50c4869cf31a48357dbacae20dec071652c087c01c76f37446dc2f54fa11f3c857ae
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/ResourceManifest.pbd
Filesize248KB
MD54308e5ffebf60f85b51724b755e60b0c
SHA150ed5c514283036bab5dc5cd202f277ca1772467
SHA25677e4d258d5e53ae7c5aa22989dc0f053e506f50769363ff64a4493efa1b4724d
SHA512ee42a8afbe4286e1056c1b71e6a47d33cb23dc15de45943532731e90fd385b1f6cd4dd0e1c7f33ed775fbaa8fcde894391dac708e42065f4328dde106b1500a0
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/SearchAttribution.pbd
Filesize63KB
MD557a392815325c0f44004d85f331175e6
SHA1d89e1b8c1eea91af7f592912554b3a223ec7e91c
SHA256ca09df317c0ef4d1d1c34c03e0729ccc48eb28e9efb575b030af8dae97e049fb
SHA5124272b06c1d92e0937660842479f1d5a9c75a092fb62be0feb9208c2baa9855e808e13a7cf7423b2c88d4061ad4bb9537782098b48fc526b519b62393d124d846
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/SearchAttribution.pbd
Filesize63KB
MD51f9c09c6bdecdfc022b01e388fab3137
SHA169eca5f435359ef914a75b137a694bb935813f5b
SHA2566fb548b324af2e5c8a35cd19255ec8576fac99bf98bb6699a78532212ee452bf
SHA5126230eee7b112a5ea5e8259a75b048bd8d836ad3d06b3905e126873e63103acf807d369080de97fac8896850a6da51a15a2fc3253b4e64f8c2223138d124c9266
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/altitude-1162.xml
Filesize150KB
MD51d51e6eba90b4f906ce24c062305dc41
SHA1c3d6b5737119bd3e2a5a1f5dc4461ac12b1504ab
SHA256dbe65e8dae5bccf407f19bfd7bfdbb358b2a0ffb456f962e504a9ad062576075
SHA512df2e12956f760c74e4373acd5ecc6a714947d72290c6080cc2cc1a779c4ae32b7915fd727be48e066a3741ff0d45f28f58cf17b92e96449f996d56ab1c7f76bb
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/com.apple.geo.analytic.12000
Filesize565B
MD520a609430757a92dc001f2dc17476101
SHA15878efbcfce90850de78396b1873770216fd9c78
SHA256bd4ceaaa241b7f85def0b714791d1ec2dd1ceea1e31d95ccef8c8c373897c598
SHA512391ed71d72f7e1d4b0f1d20738c6b81df7acc76b45405f20876e02d39db8d8ac29f904a8c9bdf7c5e4cb76b19d54275eb6632ad41e1640bbd86062a0a1427ac1
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/default-search-4255.styl
Filesize4KB
MD5ecffd97aba0c34d35b1a9814925dce20
SHA1955f9e12763a52a03e04d4ffd11aaef5d7f61c9e
SHA2569a2a568c390dd2011a7f0caaba9137e97a08d418692ce937ea893d626144acf3
SHA5120ab126628f62a7d2659e3848c619d42b57899ddefa96bd8687494f9e4c23cecad5d20c9e03f9c1c3976aae3395b521067bd94f18ab53710981bdf2770390afcb
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/[email protected]
Filesize4KB
MD50772477173e9e34a7860141b6b18a084
SHA1d28286b98e6d7de043466687dc609f2b5287560e
SHA2566ac023973bc73d4e5a24982a8f7f0ed3c4b6b12b07d5bd432db87602128599e7
SHA5126e467f22fc6607f8fb2cc23f90735e4ae4e0951a850ced6104052bc37d0554db50d3e58b5eabdbbd9978f90748d67d6a0fb1dc4e794ffc75284d133710a01618
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/publisher_attribution_dot_coms-78.pb
Filesize21KB
MD5df3e0dfd820521a756bbbc584f4bf1a9
SHA1dccf82e2be348c406faf445309ed1669d7eab7f3
SHA2567db626f6178f1a525616314cc8857e1f9729e20d4befc56fb1dee292495e557f
SHA512c78a1aefbf1035140e69b8e5e5b6e3abf4826707091e6b774ca112e93707eeb091a90bb9f883ce613914b825f1931e7f08ec86ed72f3dad4f7a6b724b9f46946
-
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/publisher_attribution_manifest_index-65.pb
Filesize2KB
MD5ba4df8801bd4124f55bfe7c130477094
SHA12136b957456e5776e5d0b996fadc2978a2cd064d
SHA256d51837f4ef49d5d2e24f675a5bfd9f8391581a435f8c193f91a8520fccb8361a
SHA512795f14ee1b7fe8d89c21c8af4e358e95e2331d60250acf91998ff3fbe8ee8c2124b11cac909be603c549508917a1af56af9f0c9c0da11da119ecddc4d3a13c65
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/ActiveTileGroup.pbd
Filesize124KB
MD5439f5de1d47b4cdc409514be5bf102f9
SHA166d3aaa7ab1c6d52d4390a767e39f879b88d4843
SHA256a085649e1c5f85f59551cf46bc30b9da8b8dac659797c3d2fb3df908f294affe
SHA5123ccbf67cf54e21caa4f3198d86b99ed02bdbd22869c0cddf6b29f38ebf4a5dd2fd4e44d043dae63fb08453776b9cf3a5d026dfc013f5f6ba6f309e5fa9229a6c
-
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/Default_Icons-17136.iconconfigpack
Filesize556KB
MD560a9b755ab271df605b8f2a0b26bcb1e
SHA12098fec72d912f48bf3bc51a186958c28dbe4cb8
SHA256a67ff86f31c7254fb033c4263e864976902d7450c4b3b05228c331fad6ecb2c7
SHA512837edbb92be079ec9c27015aac9dc1ccf76276983769c778846765ac675202eb35bc763070b8ac490e7e44d65299e0ff2832f2a2f89983e1c685e4d8a6ea6de9
-
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/ResourceManifest.pbd
Filesize248KB
MD5b827f4618882528782f8e6f265619079
SHA1fb91726d01ff7d22a262ea6a9695536f60b342c1
SHA256be7b04d61ca29c1a1aa79e534cfea8ca79f325aa67faa8aba4dd4ce35401360c
SHA51250197dadeb898cdf681bd4da9ace27000ca9e383cd29f9e185a32724a4afa2b90fea81f21107ee8f90158256c8f04a37c0a2b83817a807b438ae41ed71068d9b
-
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/SearchAttribution.pbd
Filesize63KB
MD5c1507f95536395ba6db83ae2da457183
SHA169183cc393a1fe1f227a23b32385b4785f9c071b
SHA256410672b24eb990deadbf046584ad9f3a99ca69331f0550adb2fe40f49e619ee1
SHA5120b1bcaf1e4f179c1f399ee1ab4580f95eaa2cc298a24d10e5627b6fb3443bf2866a1d5015de67859c6f7cfabc8ad1b57f1e3499f6209ef2bd6e210230c889818
-
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/com.apple.geo.analytic.12000
Filesize458B
MD5fa5aef93d195c2517a293ad0df67905b
SHA1aadd3dcaaa3178d2f23d76ca7d7d066701c3fb8f
SHA256f85f05e0058843f4fa4a91d774f5bbfdcdd8b527f6b25d992c5c4ae0f34ca025
SHA51266dd74e0aba0b76f2e9ab2e18d59c2dc710fb2e3c8fbf5ae0f94857f0dfc1d20b8b67ec348b7725270609e682b9f3b1adcac323fd4a3e1dde3a7572faba6dd79
-
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/com.apple.geo.analytic.12000
Filesize564B
MD547212a14f15f7d7be3980d8b23a33f98
SHA1eb47e0256b66d0ba66943085a4829b9464c72607
SHA256f833771f5dd52aff8656f9516f1b3fcffe1d1665b38f7c3c59e3e41c50830c00
SHA5122ab1d12348ef53097a9244e65987841f8212adc3b3abce61eb97a93e328a988f6236faedd57799555fde663db46932bd6671dc8da987b8848214d48c23601225
-
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/T/com.apple.geod/TemporaryItems/(A Document Being Saved By com.apple.geod)/networkDefaults.plist
Filesize6KB
MD52b0bc3d4b28b37889d09acc741f4ebae
SHA1060af238652083cafa7c43d79ea457eed8570429
SHA256145a9dba11445d7b6102cb19a70ef8540fd119930c9e6ef323db408e4f727575
SHA512459ccf92572f8dc284f49460dcfd4f04611f7ec2a5f14446e37d15aa85cfb094b1d2b49ca2606cb771151926dc14bfdcfa6e13da5686d212fe05c4d8cad989c3