Overview
overview
7Static
static
1URLScan
urlscan
1https://drive.google...
windows7-x64
6https://drive.google...
windows10-1703-x64
6https://drive.google...
windows10-2004-x64
6https://drive.google...
windows11-21h2-x64
6https://drive.google...
android-10-x64
7https://drive.google...
android-11-x64
7https://drive.google...
android-13-x64
7https://drive.google...
android-9-x86
7https://drive.google...
macos-10.15-amd64
4https://drive.google...
debian-12-armhf
https://drive.google...
debian-12-mipsel
https://drive.google...
debian-9-armhf
https://drive.google...
debian-9-mips
https://drive.google...
debian-9-mipsel
https://drive.google...
ubuntu-18.04-amd64
7https://drive.google...
ubuntu-20.04-amd64
6Analysis
-
max time kernel
1619s -
max time network
1413s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
25-04-2024 23:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
android-x64-20240221-en
Behavioral task
behavioral6
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
android-x64-arm64-20240221-en
Behavioral task
behavioral7
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
android-33-x64-arm64-20240229-en
Behavioral task
behavioral8
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral9
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
macos-20240410-en
Behavioral task
behavioral10
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral11
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral12
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral13
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral14
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral15
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral16
Sample
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Resource
ubuntu2004-amd64-20240221-en
General
-
Target
https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link
Malware Config
Signatures
-
Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes:
ioc process /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link"1⤵
-
/bin/zsh/bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://drive.google.com/drive/folders/141i8_BFkzcGhbKBsFw9rzvz3TwLSNleP?usp=drive_link"2⤵
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterB516C108/OneDrive.app1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.systemsoundserverd1⤵
-
/usr/sbin/systemsoundserverd/usr/sbin/systemsoundserverd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.cloudkeychainproxy31⤵
-
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountPolicyHelper1⤵
-
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵
-
/usr/sbin/spindump/usr/sbin/spindump1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.diagnosticd1⤵
-
/usr/libexec/diagnosticd/usr/libexec/diagnosticd1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.systemstats.daily1⤵