Overview

overview

4

Static

static

3

Bambu_Stud...51.exe

macos-10.15-amd64

4

resources/...x.html

macos-10.15-amd64

4

resources/...mon.js

macos-10.15-amd64

4

resources/...api.js

macos-10.15-amd64

4

resources/...ome.js

macos-10.15-amd64

4

resources/...min.js

macos-10.15-amd64

4

resources/...min.js

macos-10.15-amd64

4

resources/...on2.js

macos-10.15-amd64

4

resources/...umd.js

macos-10.15-amd64

4

resources/...umd.js

macos-10.15-amd64

4

resources/...api.js

macos-10.15-amd64

4

resources/...ive.js

macos-10.15-amd64

4

resources/...ent.js

macos-10.15-amd64

4

resources/...ule.js

macos-10.15-amd64

4

resources/...ams.js

macos-10.15-amd64

4

resources/...ist.js

macos-10.15-amd64

4

resources/...ils.js

macos-10.15-amd64

4

resources/...lar.js

macos-10.15-amd64

4

resources/...lar.js

macos-10.15-amd64

4

resources/...lar.js

macos-10.15-amd64

4

resources/...lar.js

macos-10.15-amd64

4

resources/...int.js

macos-10.15-amd64

4

resources/...dex.js

macos-10.15-amd64

4

resources/...int.js

macos-10.15-amd64

4

resources/...dex.js

macos-10.15-amd64

4

resources/...ses.js

macos-10.15-amd64

4

resources/...dex.js

macos-10.15-amd64

4

resources/...ses.js

macos-10.15-amd64

4

resources/...ore.js

macos-10.15-amd64

4

resources/...lts.js

macos-10.15-amd64

4

resources/...ter.js

macos-10.15-amd64

4

resources/...dex.js

macos-10.15-amd64

4

Analysis

  • max time kernel
    39s
  • max time network
    120s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    16-04-2024 21:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/web/guide/swiper/core/classes/addClasses.js

  • Size

    1KB

  • MD5

    0b6f6bb20a721f12bd9659e4cf450bf7

  • SHA1

    9787172ff886f9401261d330fa09abea150c0400

  • SHA256

    8ad5152dfd2726e233a59cadeeda87ddf1aab6ccb40427f23846b7629376c187

  • SHA512

    58edb9658ad37b888afd8c9f3e56e9c12b64f405c86974d7a1f6f81d01a9a61212ba20c4822c3c3bd380db6f9a08e8dbb2b5230179d556227394bdf5f90addf7

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 5 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/resources/web/guide/swiper/core/classes/addClasses.js\""
    1⤵
      PID:516
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/resources/web/guide/swiper/core/classes/addClasses.js\""
      1⤵
        PID:516
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/resources/web/guide/swiper/core/classes/addClasses.js
        1⤵
          PID:516
          • /bin/zsh
            /bin/zsh -c /Users/run/resources/web/guide/swiper/core/classes/addClasses.js
            2⤵
              PID:517
            • /Users/run/resources/web/guide/swiper/core/classes/addClasses.js
              /Users/run/resources/web/guide/swiper/core/classes/addClasses.js
              2⤵
                PID:517
              • /bin/sh
                sh /Users/run/resources/web/guide/swiper/core/classes/addClasses.js
                2⤵
                  PID:517
                • /bin/bash
                  sh /Users/run/resources/web/guide/swiper/core/classes/addClasses.js
                  2⤵
                    PID:517
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.sysmond
                  1⤵
                    PID:518
                  • /usr/libexec/sysmond
                    /usr/libexec/sysmond
                    1⤵
                      PID:518

                    Network

                    MITRE ATT&CK Matrix ATT&CK v13

                    Initial Access

                    Execution

                    Persistence

                    Privilege Escalation

                    Defense Evasion

                    Hide Artifacts

                    1
                    T1564

                    Resource Forking

                    1
                    T1564.009

                    Credential Access

                    Discovery

                    Lateral Movement

                    Collection

                    Exfiltration

                    Command and Control

                    Impact

                    Resource Development

                    Reconnaissance

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads