Analysis
-
max time kernel
355s -
max time network
395s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
28/04/2024, 15:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwiHgZf6mOWFAxVLpVoFHZS-Bi8YABAAGgJ2dQ&ase=2&gclid=CjwKCAjw57exBhAsEiwAaIxaZqEJDWThkMQvvkjwtR7nblKWbbnFWVZWcC0KfQz7sFheRr4R-CyydxoCIxMQAvD_BwE&ei=RGcuZofSOP7e5NoP1qyysAs&ohost=www.google.com&cid=CAESVuD2vDdNTLimBBsnOl3M46SyXb-noHx6yiTVo6krp4jBn8zcJVNeejO4vvXgexHtXCWR2esoeiwvG1S96Q8IfXnVJGdLEb3u0-83Uq5WlbR_rEIpk6Cx&sig=AOD64_3JRNUwGHO59QqDhXVYscD4AiUk5w&q&sqi=2&nis=4&adurl&ved=2ahUKEwiHhI76mOWFAxV-L1kFHVaWDLYQ0Qx6BAgJEAE
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwiHgZf6mOWFAxVLpVoFHZS-Bi8YABAAGgJ2dQ&ase=2&gclid=CjwKCAjw57exBhAsEiwAaIxaZqEJDWThkMQvvkjwtR7nblKWbbnFWVZWcC0KfQz7sFheRr4R-CyydxoCIxMQAvD_BwE&ei=RGcuZofSOP7e5NoP1qyysAs&ohost=www.google.com&cid=CAESVuD2vDdNTLimBBsnOl3M46SyXb-noHx6yiTVo6krp4jBn8zcJVNeejO4vvXgexHtXCWR2esoeiwvG1S96Q8IfXnVJGdLEb3u0-83Uq5WlbR_rEIpk6Cx&sig=AOD64_3JRNUwGHO59QqDhXVYscD4AiUk5w&q&sqi=2&nis=4&adurl&ved=2ahUKEwiHhI76mOWFAxV-L1kFHVaWDLYQ0Qx6BAgJEAE
Resource
macos-20240410-en
General
-
Target
https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwiHgZf6mOWFAxVLpVoFHZS-Bi8YABAAGgJ2dQ&ase=2&gclid=CjwKCAjw57exBhAsEiwAaIxaZqEJDWThkMQvvkjwtR7nblKWbbnFWVZWcC0KfQz7sFheRr4R-CyydxoCIxMQAvD_BwE&ei=RGcuZofSOP7e5NoP1qyysAs&ohost=www.google.com&cid=CAESVuD2vDdNTLimBBsnOl3M46SyXb-noHx6yiTVo6krp4jBn8zcJVNeejO4vvXgexHtXCWR2esoeiwvG1S96Q8IfXnVJGdLEb3u0-83Uq5WlbR_rEIpk6Cx&sig=AOD64_3JRNUwGHO59QqDhXVYscD4AiUk5w&q&sqi=2&nis=4&adurl&ved=2ahUKEwiHhI76mOWFAxV-L1kFHVaWDLYQ0Qx6BAgJEAE
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwiHgZf6mOWFAxVLpVoFHZS-Bi8YABAAGgJ2dQ&ase=2&gclid=CjwKCAjw57exBhAsEiwAaIxaZqEJDWThkMQvvkjwtR7nblKWbbnFWVZWcC0KfQz7sFheRr4R-CyydxoCIxMQAvD_BwE&ei=RGcuZofSOP7e5NoP1qyysAs&ohost=www.google.com&cid=CAESVuD2vDdNTLimBBsnOl3M46SyXb-noHx6yiTVo6krp4jBn8zcJVNeejO4vvXgexHtXCWR2esoeiwvG1S96Q8IfXnVJGdLEb3u0-83Uq5WlbR_rEIpk6Cx&sig=AOD64_3JRNUwGHO59QqDhXVYscD4AiUk5w&q&sqi=2&nis=4&adurl&ved=2ahUKEwiHhI76mOWFAxV-L1kFHVaWDLYQ0Qx6BAgJEAE\""1⤵PID:485
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwiHgZf6mOWFAxVLpVoFHZS-Bi8YABAAGgJ2dQ&ase=2&gclid=CjwKCAjw57exBhAsEiwAaIxaZqEJDWThkMQvvkjwtR7nblKWbbnFWVZWcC0KfQz7sFheRr4R-CyydxoCIxMQAvD_BwE&ei=RGcuZofSOP7e5NoP1qyysAs&ohost=www.google.com&cid=CAESVuD2vDdNTLimBBsnOl3M46SyXb-noHx6yiTVo6krp4jBn8zcJVNeejO4vvXgexHtXCWR2esoeiwvG1S96Q8IfXnVJGdLEb3u0-83Uq5WlbR_rEIpk6Cx&sig=AOD64_3JRNUwGHO59QqDhXVYscD4AiUk5w&q&sqi=2&nis=4&adurl&ved=2ahUKEwiHhI76mOWFAxV-L1kFHVaWDLYQ0Qx6BAgJEAE\""1⤵PID:485
-
/usr/bin/sudosudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwiHgZf6mOWFAxVLpVoFHZS-Bi8YABAAGgJ2dQ&ase=2&gclid=CjwKCAjw57exBhAsEiwAaIxaZqEJDWThkMQvvkjwtR7nblKWbbnFWVZWcC0KfQz7sFheRr4R-CyydxoCIxMQAvD_BwE&ei=RGcuZofSOP7e5NoP1qyysAs&ohost=www.google.com&cid=CAESVuD2vDdNTLimBBsnOl3M46SyXb-noHx6yiTVo6krp4jBn8zcJVNeejO4vvXgexHtXCWR2esoeiwvG1S96Q8IfXnVJGdLEb3u0-83Uq5WlbR_rEIpk6Cx&sig=AOD64_3JRNUwGHO59QqDhXVYscD4AiUk5w&q&sqi=2&nis=4&adurl&ved=2ahUKEwiHhI76mOWFAxV-L1kFHVaWDLYQ0Qx6BAgJEAE"1⤵PID:485
-
/bin/zsh/bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwiHgZf6mOWFAxVLpVoFHZS-Bi8YABAAGgJ2dQ&ase=2&gclid=CjwKCAjw57exBhAsEiwAaIxaZqEJDWThkMQvvkjwtR7nblKWbbnFWVZWcC0KfQz7sFheRr4R-CyydxoCIxMQAvD_BwE&ei=RGcuZofSOP7e5NoP1qyysAs&ohost=www.google.com&cid=CAESVuD2vDdNTLimBBsnOl3M46SyXb-noHx6yiTVo6krp4jBn8zcJVNeejO4vvXgexHtXCWR2esoeiwvG1S96Q8IfXnVJGdLEb3u0-83Uq5WlbR_rEIpk6Cx&sig=AOD64_3JRNUwGHO59QqDhXVYscD4AiUk5w&q&sqi=2&nis=4&adurl&ved=2ahUKEwiHhI76mOWFAxV-L1kFHVaWDLYQ0Qx6BAgJEAE"2⤵PID:486
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵PID:529
-
/usr/sbin/spindump/usr/sbin/spindump1⤵PID:529
-
/usr/libexec/xpcproxyxpcproxy com.apple.diagnosticd1⤵PID:530
-
/usr/libexec/diagnosticd/usr/libexec/diagnosticd1⤵PID:530