Overview
overview
4Static
static
1systemd-journald
windows7-x64
1systemd-journald
windows10-1703-x64
1systemd-journald
windows10-2004-x64
1systemd-journald
windows11-21h2-x64
1systemd-journald
android-10-x64
systemd-journald
android-11-x64
systemd-journald
android-13-x64
systemd-journald
android-9-x86
systemd-journald
macos-10.15-amd64
4systemd-journald
debian-12-armhf
systemd-journald
debian-12-mipsel
systemd-journald
debian-9-armhf
systemd-journald
debian-9-mips
systemd-journald
debian-9-mipsel
systemd-journald
ubuntu-18.04-amd64
1systemd-journald
ubuntu-20.04-amd64
1Analysis
-
max time kernel
1787s -
max time network
1797s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
20-04-2024 18:28
Static task
static1
Behavioral task
behavioral1
Sample
systemd-journald
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
systemd-journald
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
systemd-journald
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
systemd-journald
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
systemd-journald
Resource
android-x64-20240221-en
Behavioral task
behavioral6
Sample
systemd-journald
Resource
android-x64-arm64-20240221-en
Behavioral task
behavioral7
Sample
systemd-journald
Resource
android-33-x64-arm64-20240229-en
Behavioral task
behavioral8
Sample
systemd-journald
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral9
Sample
systemd-journald
Resource
macos-20240410-en
Behavioral task
behavioral10
Sample
systemd-journald
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral11
Sample
systemd-journald
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral12
Sample
systemd-journald
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral13
Sample
systemd-journald
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral14
Sample
systemd-journald
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral15
Sample
systemd-journald
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral16
Sample
systemd-journald
Resource
ubuntu2004-amd64-20240221-en
General
-
Target
systemd-journald
-
Size
196KB
-
MD5
d283b51301e9fa41277fc65aa9ae2c47
-
SHA1
58858cd80e51b751e5936dbd3b3fd624845cab77
-
SHA256
00d6840d4a787aec41a04f1679324321686ba96ed9f4ba3e2026b400f1f7901b
-
SHA512
6a0d1480d0ffefd130a6f5e3bf9478e38142676e1a1ae7c74741fac447d3fceae08b02100df80e0f91e9d1ed0fff702c6f49b235f8c6ffc2de650491ec7db0ab
-
SSDEEP
3072:V+nJgnskJxqD8MPJSFqR2AhqtAOAFFwpfqALJ/gtoJzoLW8eJyBqjAB2tzCGgu:VOgsk1BIfkXpCAL1gtlW8e8Bqjntz0
Malware Config
Signatures
-
Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes:
ioc process /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
Processes
-
/usr/libexec/dmd/usr/libexec/dmd1⤵
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/systemd-journald\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/systemd-journald\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/systemd-journald1⤵
-
/bin/zsh/bin/zsh -c /Users/run/systemd-journald2⤵
-
/Users/run/systemd-journald/Users/run/systemd-journald2⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.cloudkeychainproxy31⤵
-
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy1⤵
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.assistantd1⤵
-
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.geod1⤵
-
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.secinitd1⤵
-
/usr/libexec/secinitd/usr/libexec/secinitd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.ContactsAccountsService1⤵
-
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.suggestd1⤵
-
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.knowledge-agent1⤵
-
/usr/libexec/knowledge-agent/usr/libexec/knowledge-agent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.routined1⤵
-
/usr/libexec/routined/usr/libexec/routined LAUNCHED_BY_LAUNCHD1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A1⤵
-
/usr/libexec/neagent/usr/libexec/neagent1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.Maps.mapspushd1⤵
-
/System/Library/CoreServices/mapspushd/System/Library/CoreServices/mapspushd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.siri.context.service1⤵
-
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService1⤵
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.newsyslog1⤵
-
/usr/sbin/newsyslog/usr/sbin/newsyslog1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.CoreAuthentication.agent1⤵
-
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.akd1⤵
-
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountPolicyHelper1⤵
-
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵
-
/usr/sbin/spindump/usr/sbin/spindump1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.diagnosticd1⤵
-
/usr/libexec/diagnosticd/usr/libexec/diagnosticd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.CalendarNotification.CalNCService 3371⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.rtcreportingd1⤵
-
/usr/libexec/rtcreportingd/usr/libexec/rtcreportingd1⤵
-
/System/Library/PrivateFrameworks/CalendarNotification.framework/Versions/A/XPCServices/CalNCService.xpc/Contents/MacOS/CalNCService/System/Library/PrivateFrameworks/CalendarNotification.framework/Versions/A/XPCServices/CalNCService.xpc/Contents/MacOS/CalNCService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.adid1⤵
-
/System/Library/PrivateFrameworks/CoreADI.framework/adid/System/Library/PrivateFrameworks/CoreADI.framework/adid1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.icloud.findmydeviced1⤵
-
/usr/libexec/findmydeviced/usr/libexec/findmydeviced1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.tailspind1⤵
-
/usr/libexec/tailspind/usr/libexec/tailspind1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbdFilesize
124KB
MD5a657dedc87699c34bd36b62c328ea804
SHA19db8bd5d3fd1502042d16557d88213a3d7a5dad0
SHA256a73fd97a8897cd95f43315b08cf33e86cda5946f2cf7bf2b5471b8a288a1b53f
SHA512705c8bacea379826f4a0c9383d177c8f6a7cedbf161008427e97f73b2c36769ec16e1ee20d766479482b26f187644621b1342b599fa00acbf8dca3d4175282d1
-
/Users/run/Library/Caches/GeoServices/Experiments.pbdFilesize
291B
MD5b5969df58206dbe1ddd7e66488a9f795
SHA15e5b7612c160f909646b1ba6d58bfa70da449827
SHA256fc06886ab3b8d66941e80a73eb36c9f676c7efdfbeac61d65b80d368ddc96b56
SHA51242d348092446caacd56fffcec62419c87aeadec467136a21b5af26670cb8a8142fd30e42e4f402bdbc2846e47be6de4de3075ab881797dc38bd8842f48d44d22
-
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xmlFilesize
167KB
MD5a645869f7bf432953f0292ca5fd17ad8
SHA19063c8541f8d4d81d301df8b359a30071d42b119
SHA25604daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9
SHA5126449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4
-
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.dbFilesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.dbFilesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
-
/var/root/Library/Caches/rtcreportingd/events/NRM_Events_2024-04-20-18-56-39.eventFilesize
5KB
MD5fc5d2ae98600bf7e0a434d9dbe776f23
SHA129ebf4e151b832f725a4fb740598ebff4b50f646
SHA256cb260f4ca377977c168b0de5add7630ceb4d0fc5f633b403e3c32c6e7e3b46a3
SHA5125ab6e96f29fe231a7fdfdbcd5dbc01ea87dc28917a5666deff5ab5eaab85b39c20da24477efe446c9034283c50219983ac1cb6a52838e0f065edd4875041bcb9