f911e04176476439bf4f10b4a476627bb3e401025b225eefcb529d8a7d25f5e6

Analysis

max time kernel
126s
max time network
160s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
16-04-2024 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/web/guide/js/globalapi.js
Size

6KB
MD5

42cbfb1306853a21e74e89010ffae2a1
SHA1

40efb14f1bacc5660343fea59e2595e6055fc443
SHA256

e4ed03945e3b3241f0465acc220d80b709579edf98d53d1a6fed7e0b58165a01
SHA512

c40f60bc47659de40e86da7da7415596965fc907cb18045e22e195e69c61dc688be7d112dabb18419b77bb05a5b5806c98ba2d11374823b0b777726006bb64ce
SSDEEP

192:7EjWh933jvQ4bJQIR0VhAjaS1/1F86ZJPkaL:4o3j422mDLjL

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	process
sh -c "sudo /bin/zsh -c \"/Users/run/resources/web/guide/js/globalapi.js\""
sudo /bin/zsh -c /Users/run/resources/web/guide/js/globalapi.js
/bin/zsh -c /Users/run/resources/web/guide/js/globalapi.js
/Users/run/resources/web/guide/js/globalapi.js
sh /Users/run/resources/web/guide/js/globalapi.js

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/resources/web/guide/js/globalapi.js\""
1⤵
PID:511

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/resources/web/guide/js/globalapi.js\""
1⤵
PID:511

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/resources/web/guide/js/globalapi.js
1⤵
PID:511

/bin/zsh
/bin/zsh -c /Users/run/resources/web/guide/js/globalapi.js
2⤵
PID:512

/Users/run/resources/web/guide/js/globalapi.js
/Users/run/resources/web/guide/js/globalapi.js
2⤵
PID:512

/bin/sh
sh /Users/run/resources/web/guide/js/globalapi.js
2⤵
PID:512

/bin/bash
sh /Users/run/resources/web/guide/js/globalapi.js
2⤵
PID:512

/*------------------
"/*------------------" Date Function "------------------------*/ "
3⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:621

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:621

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads