Overview

overview

1

Static

static

1

Slack-Apps

macos-10.15-amd64

1

Slack-Apps

macos-10.15-amd64

1

Resubmissions

23/03/2024, 14:22

240323-rpprysge7910

16/01/2024, 00:35

240116-axpcqaafg51

Analysis

  • max time kernel
    252s
  • max time network
    145s
  • platform
    macos-10.15_amd64
  • resource
    macos-20231201-en
  • resource tags

    arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    16/01/2024, 00:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Slack-Apps
  • Size 996KB
  • Sample240116-axpcqaafg5
  • SHA256 bd8adfae24dc7a6b633d3b5342d11978e6b7418fa43be6eca0378f17d0bb7565
  • MD5 SHA1 SHA512 SSDEEP
Score
1/10

Malware Config

Signatures

Processes

  • /usr/sbin/spctl
    /usr/sbin/spctl --test-devid-status
    1⤵
      PID:518
    • /bin/sh
      sh -c "sudo /bin/zsh -c \"/Users/run/Slack-Apps\""
      1⤵
        PID:520
      • /bin/bash
        sh -c "sudo /bin/zsh -c \"/Users/run/Slack-Apps\""
        1⤵
          PID:520
        • /bin/bash
          sh -c "sudo /bin/zsh -c \"/Users/run/Slack-Apps\""
          1⤵
            PID:520
          • /usr/bin/sudo
            sudo /bin/zsh -c /Users/run/Slack-Apps
            1⤵
              PID:520
            • /usr/bin/sudo
              sudo /bin/zsh -c /Users/run/Slack-Apps
              1⤵
                PID:520
                • /bin/zsh
                  /bin/zsh -c /Users/run/Slack-Apps
                  2⤵
                    PID:521
                  • /bin/zsh
                    /bin/zsh -c /Users/run/Slack-Apps
                    2⤵
                      PID:521
                    • /Users/run/Slack-Apps
                      /Users/run/Slack-Apps
                      2⤵
                        PID:521
                      • /Users/run/Slack-Apps
                        /Users/run/Slack-Apps
                        2⤵
                          PID:521
                      • /usr/bin/syslog
                        /usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
                        1⤵
                          PID:519
                        • /bin/sh
                          sh -c "osascript -e 'tell application \"Terminal\" to close first window' & exit"
                          1⤵
                            PID:523
                          • /bin/bash
                            sh -c "osascript -e 'tell application \"Terminal\" to close first window' & exit"
                            1⤵
                              PID:523
                            • /bin/bash
                              sh -c "osascript -e 'tell application \"Terminal\" to close first window' & exit"
                              1⤵
                                PID:523
                                • /usr/bin/osascript
                                  osascript -e "tell application \"Terminal\" to close first window"
                                  2⤵
                                    PID:524
                                  • /usr/bin/osascript
                                    osascript -e "tell application \"Terminal\" to close first window"
                                    2⤵
                                      PID:524
                                  • /bin/sh
                                    sh -c "dscl . authonly \"root\" \"\""
                                    1⤵
                                      PID:525
                                    • /bin/bash
                                      sh -c "dscl . authonly \"root\" \"\""
                                      1⤵
                                        PID:525
                                      • /bin/bash
                                        sh -c "dscl . authonly \"root\" \"\""
                                        1⤵
                                          PID:525
                                        • /usr/bin/dscl
                                          dscl . authonly root
                                          1⤵
                                            PID:525
                                          • /usr/bin/dscl
                                            dscl . authonly root
                                            1⤵
                                              PID:525
                                            • /bin/sh
                                              sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                              1⤵
                                                PID:526
                                              • /bin/bash
                                                sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                1⤵
                                                  PID:526
                                                • /bin/bash
                                                  sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                  1⤵
                                                    PID:526
                                                  • /usr/bin/osascript
                                                    osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                    1⤵
                                                      PID:526
                                                    • /usr/bin/osascript
                                                      osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                      1⤵
                                                        PID:526
                                                      • /usr/libexec/xpcproxy
                                                        xpcproxy com.apple.ViewBridgeAuxiliary
                                                        1⤵
                                                          PID:530
                                                        • /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                                          /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                                          1⤵
                                                            PID:530
                                                          • /usr/sbin/kextcache
                                                            /usr/sbin/kextcache -F -system-prelinked-kernel
                                                            1⤵
                                                              PID:531
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.spindump
                                                              1⤵
                                                                PID:534
                                                              • /usr/sbin/spindump
                                                                /usr/sbin/spindump
                                                                1⤵
                                                                  PID:534
                                                                • /usr/libexec/xpcproxy
                                                                  xpcproxy com.apple.spindump_agent
                                                                  1⤵
                                                                    PID:535
                                                                  • /usr/libexec/spindump_agent
                                                                    /usr/libexec/spindump_agent
                                                                    1⤵
                                                                      PID:535
                                                                    • /usr/bin/bzip2
                                                                      /usr/bin/bzip2 -f /var/log/wifi.log.0
                                                                      1⤵
                                                                        PID:558
                                                                      • /usr/libexec/xpcproxy
                                                                        xpcproxy com.apple.audio.systemsoundserverd
                                                                        1⤵
                                                                          PID:559
                                                                        • /usr/sbin/systemsoundserverd
                                                                          /usr/sbin/systemsoundserverd
                                                                          1⤵
                                                                            PID:559
                                                                          • /bin/sh
                                                                            sh -c "dscl . authonly \"root\" \"root\""
                                                                            1⤵
                                                                              PID:560
                                                                            • /bin/bash
                                                                              sh -c "dscl . authonly \"root\" \"root\""
                                                                              1⤵
                                                                                PID:560
                                                                              • /bin/bash
                                                                                sh -c "dscl . authonly \"root\" \"root\""
                                                                                1⤵
                                                                                  PID:560
                                                                                • /usr/bin/dscl
                                                                                  dscl . authonly root root
                                                                                  1⤵
                                                                                    PID:560
                                                                                  • /usr/bin/dscl
                                                                                    dscl . authonly root root
                                                                                    1⤵
                                                                                      PID:560
                                                                                    • /bin/sh
                                                                                      sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                      1⤵
                                                                                        PID:561
                                                                                      • /bin/bash
                                                                                        sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                        1⤵
                                                                                          PID:561
                                                                                        • /bin/bash
                                                                                          sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                          1⤵
                                                                                            PID:561
                                                                                          • /usr/bin/osascript
                                                                                            osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                            1⤵
                                                                                              PID:561
                                                                                            • /usr/bin/osascript
                                                                                              osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                              1⤵
                                                                                                PID:561
                                                                                              • /usr/libexec/xpcproxy
                                                                                                xpcproxy com.apple.ReportCrash.Root
                                                                                                1⤵
                                                                                                  PID:564
                                                                                                • /System/Library/CoreServices/ReportCrash
                                                                                                  /System/Library/CoreServices/ReportCrash daemon
                                                                                                  1⤵
                                                                                                    PID:564
                                                                                                  • /usr/libexec/xpcproxy
                                                                                                    xpcproxy com.apple.ReportMemoryException
                                                                                                    1⤵
                                                                                                      PID:566
                                                                                                    • /usr/libexec/ReportMemoryException
                                                                                                      /usr/libexec/ReportMemoryException
                                                                                                      1⤵
                                                                                                        PID:566
                                                                                                      • /bin/sh
                                                                                                        sh -c "dscl . authonly \"root\" \"root\""
                                                                                                        1⤵
                                                                                                          PID:567
                                                                                                        • /bin/bash
                                                                                                          sh -c "dscl . authonly \"root\" \"root\""
                                                                                                          1⤵
                                                                                                            PID:567
                                                                                                          • /bin/bash
                                                                                                            sh -c "dscl . authonly \"root\" \"root\""
                                                                                                            1⤵
                                                                                                              PID:567
                                                                                                            • /usr/bin/dscl
                                                                                                              dscl . authonly root root
                                                                                                              1⤵
                                                                                                                PID:567
                                                                                                              • /usr/bin/dscl
                                                                                                                dscl . authonly root root
                                                                                                                1⤵
                                                                                                                  PID:567
                                                                                                                • /bin/sh
                                                                                                                  sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                  1⤵
                                                                                                                    PID:568
                                                                                                                  • /bin/bash
                                                                                                                    sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                    1⤵
                                                                                                                      PID:568
                                                                                                                    • /bin/bash
                                                                                                                      sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                      1⤵
                                                                                                                        PID:568
                                                                                                                      • /usr/bin/osascript
                                                                                                                        osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                                                        1⤵
                                                                                                                          PID:568
                                                                                                                        • /usr/bin/osascript
                                                                                                                          osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                                                          1⤵
                                                                                                                            PID:568
                                                                                                                          • /bin/sh
                                                                                                                            sh -c "dscl . authonly \"root\" \"1234\""
                                                                                                                            1⤵
                                                                                                                              PID:580
                                                                                                                            • /bin/bash
                                                                                                                              sh -c "dscl . authonly \"root\" \"1234\""
                                                                                                                              1⤵
                                                                                                                                PID:580
                                                                                                                              • /bin/bash
                                                                                                                                sh -c "dscl . authonly \"root\" \"1234\""
                                                                                                                                1⤵
                                                                                                                                  PID:580
                                                                                                                                • /usr/bin/dscl
                                                                                                                                  dscl . authonly root 1234
                                                                                                                                  1⤵
                                                                                                                                    PID:580
                                                                                                                                  • /usr/bin/dscl
                                                                                                                                    dscl . authonly root 1234
                                                                                                                                    1⤵
                                                                                                                                      PID:580
                                                                                                                                    • /bin/sh
                                                                                                                                      sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                                      1⤵
                                                                                                                                        PID:581
                                                                                                                                      • /bin/bash
                                                                                                                                        sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                                        1⤵
                                                                                                                                          PID:581
                                                                                                                                        • /bin/bash
                                                                                                                                          sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                                          1⤵
                                                                                                                                            PID:581
                                                                                                                                          • /usr/bin/osascript
                                                                                                                                            osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                                                                            1⤵
                                                                                                                                              PID:581
                                                                                                                                            • /usr/bin/osascript
                                                                                                                                              osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                                                                              1⤵
                                                                                                                                                PID:581
                                                                                                                                              • /bin/sh
                                                                                                                                                sh -c "dscl . authonly \"root\" \"root\""
                                                                                                                                                1⤵
                                                                                                                                                  PID:582
                                                                                                                                                • /bin/bash
                                                                                                                                                  sh -c "dscl . authonly \"root\" \"root\""
                                                                                                                                                  1⤵
                                                                                                                                                    PID:582
                                                                                                                                                  • /bin/bash
                                                                                                                                                    sh -c "dscl . authonly \"root\" \"root\""
                                                                                                                                                    1⤵
                                                                                                                                                      PID:582
                                                                                                                                                    • /usr/bin/dscl
                                                                                                                                                      dscl . authonly root root
                                                                                                                                                      1⤵
                                                                                                                                                        PID:582
                                                                                                                                                      • /usr/bin/dscl
                                                                                                                                                        dscl . authonly root root
                                                                                                                                                        1⤵
                                                                                                                                                          PID:582
                                                                                                                                                        • /bin/sh
                                                                                                                                                          sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:583
                                                                                                                                                          • /bin/bash
                                                                                                                                                            sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:583
                                                                                                                                                            • /bin/bash
                                                                                                                                                              sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:583
                                                                                                                                                              • /usr/bin/osascript
                                                                                                                                                                osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:583
                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                  osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:583
                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                    xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:584
                                                                                                                                                                    • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                      /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:584
                                                                                                                                                                      • /bin/sh
                                                                                                                                                                        sh -c "dscl . authonly \"root\" \"p:true \""
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:591
                                                                                                                                                                        • /bin/bash
                                                                                                                                                                          sh -c "dscl . authonly \"root\" \"p:true \""
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:591
                                                                                                                                                                          • /bin/bash
                                                                                                                                                                            sh -c "dscl . authonly \"root\" \"p:true \""
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:591
                                                                                                                                                                            • /usr/bin/dscl
                                                                                                                                                                              dscl . authonly root "p:true "
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:591
                                                                                                                                                                              • /usr/bin/dscl
                                                                                                                                                                                dscl . authonly root "p:true "
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:591
                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                  sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:592
                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                    sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:592
                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                      sh -c "osascript -e 'display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:592
                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                        osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:592
                                                                                                                                                                                        • /usr/bin/osascript
                                                                                                                                                                                          osascript -e "display dialog \"Required Application Helper. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:592

                                                                                                                                                                                          Network

                                                                                                                                                                                                MITRE ATT&CK Matrix

                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                Downloads

                                                                                                                                                                                                wifi.log.0.bz2
                                                                                                                                                                                                • Path /private/var/log/wifi.log.0.bz2
                                                                                                                                                                                                • Size 639B
                                                                                                                                                                                                • SHA256 02e30d34ae9adef93b758a95ba523a658f9f98e988a0be2949b8d83b31474656
                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                data.data
                                                                                                                                                                                                • Path /private/var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                • SHA256 e8f58fd6e6563453a63707250ff072c4cc76abf1340ded1ab7bc8514fdc5a525
                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                data.data
                                                                                                                                                                                                • Path /private/var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                • SHA256 692adca41c874646a7ca501310b984dbccb406ef0c746961bf7a7bcfc0746990
                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                data.data
                                                                                                                                                                                                • Path /private/var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                • SHA256 505ce0d01714129300d4f29fbbc190e29de5a7fc4f434a708f44156d776b5cef
                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                Submit Download