Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

AnyDesk.exe

macos-10.15-amd64

1

Resubmissions

08/02/2024, 20:06

240208-yvqprsbh98 7

08/02/2024, 20:04

240208-ytg18sbh89 7

08/02/2024, 20:02

240208-ysb4laac9y 1

08/02/2024, 20:02

240208-yr4r8abh77 1

08/02/2024, 19:58

240208-yqcbksbh63 3

08/02/2024, 19:54

240208-ymx4wabh38 7

08/02/2024, 19:52

240208-ylw57abh26 1

08/02/2024, 19:51

240208-yk2z2sac4v 1

08/02/2024, 19:50

240208-yklytsbg95 1

08/02/2024, 19:46

240208-yg8y7abg62 3

Analysis

  • max time kernel
    981s
  • max time network
    1803s
  • platform
    macos-10.15_amd64
  • resource
    macos-20231201-en
  • resource tags

    arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    08/02/2024, 20:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AnyDesk.exe

  • Size

    5.0MB

  • MD5

    a21768190f3b9feae33aaef660cb7a83

  • SHA1

    24780657328783ef50ae0964b23288e68841a421

  • SHA256

    55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047

  • SHA512

    ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62

  • SSDEEP

    98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x

Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/AnyDesk.exe\""
    1⤵
      PID:519
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/AnyDesk.exe\""
      1⤵
        PID:519
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/AnyDesk.exe
        1⤵
          PID:519
          • /bin/zsh
            /bin/zsh -c /Users/run/AnyDesk.exe
            2⤵
              PID:521
            • /Users/run/AnyDesk.exe
              /Users/run/AnyDesk.exe
              2⤵
                PID:521
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.audio.systemsoundserverd
              1⤵
                PID:542
              • /usr/sbin/systemsoundserverd
                /usr/sbin/systemsoundserverd
                1⤵
                  PID:542
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.pbs
                  1⤵
                    PID:544
                  • /System/Library/CoreServices/pbs
                    /System/Library/CoreServices/pbs
                    1⤵
                      PID:544
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.audio.AudioComponentRegistrar
                      1⤵
                        PID:545
                      • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                        /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                        1⤵
                          PID:545
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.CoreAuthentication.agent
                          1⤵
                            PID:567
                          • /System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
                            /System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
                            1⤵
                              PID:567
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.spindump
                              1⤵
                                PID:569
                              • /usr/sbin/spindump
                                /usr/sbin/spindump
                                1⤵
                                  PID:569
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.diagnosticd
                                  1⤵
                                    PID:570
                                  • /usr/libexec/diagnosticd
                                    /usr/libexec/diagnosticd
                                    1⤵
                                      PID:570
                                    • /usr/sbin/spctl
                                      /usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
                                      1⤵
                                        PID:578

                                      Network

                                      MITRE ATT&CK Matrix

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads