Overview
overview
10Static
static
3000.exe
windows10-2004-x64
000.exe
macos-10.15-amd64
4Ana.exe
windows10-2004-x64
Ana.exe
macos-10.15-amd64
4Bad Rabit.exe
windows10-2004-x64
10Bad Rabit.exe
macos-10.15-amd64
1Desktop Puzzle.exe
windows10-2004-x64
1Desktop Puzzle.exe
macos-10.15-amd64
1Memz.exe
windows10-2004-x64
7Memz.exe
macos-10.15-amd64
1NoEscape.exe
windows10-2004-x64
NoEscape.exe
macos-10.15-amd64
1WannaCrypt0r.exe
windows10-2004-x64
10WannaCrypt0r.exe
macos-10.15-amd64
1Resubmissions
08-06-2024 08:50
240608-krvyesae91 1008-05-2024 16:15
240508-tqnx6ach3w 1008-05-2024 16:07
240508-tkr3mafa54 1001-05-2024 18:02
240501-wmf49acg3s 627-04-2024 08:46
240427-kpfeysff8s 1025-04-2024 21:25
240425-z9y55afb7v 1025-04-2024 21:16
240425-z4pphafa97 1025-04-2024 18:27
240425-w3929sde33 1025-04-2024 18:17
240425-ww4a5sdc8x 10Analysis
-
max time kernel
51s -
max time network
137s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
25-04-2024 17:55
Static task
static1
Behavioral task
behavioral1
Sample
000.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
000.exe
Resource
macos-20240410-en
Behavioral task
behavioral3
Sample
Ana.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
Ana.exe
Resource
macos-20240410-en
Behavioral task
behavioral5
Sample
Bad Rabit.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
Bad Rabit.exe
Resource
macos-20240410-en
Behavioral task
behavioral7
Sample
Desktop Puzzle.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral8
Sample
Desktop Puzzle.exe
Resource
macos-20240410-en
Behavioral task
behavioral9
Sample
Memz.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral10
Sample
Memz.exe
Resource
macos-20240410-en
Behavioral task
behavioral11
Sample
NoEscape.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
NoEscape.exe
Resource
macos-20240410-en
Behavioral task
behavioral13
Sample
WannaCrypt0r.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral14
Sample
WannaCrypt0r.exe
Resource
macos-20240410-en
General
-
Target
Bad Rabit.exe
-
Size
431KB
-
MD5
fbbdc39af1139aebba4da004475e8839
-
SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0
-
SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
-
SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
-
SSDEEP
12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Bad Rabit.exe\""1⤵PID:488
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Bad Rabit.exe\""1⤵PID:488
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Bad Rabit.exe"1⤵PID:488
-
/bin/zsh/bin/zsh -c "/Users/run/Bad Rabit.exe"2⤵PID:489
-
-
/Users/run/Bad/Users/run/Bad Rabit.exe2⤵PID:489
-
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵PID:510
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0BF23177/OneDrive.app1⤵PID:511