evilquest | 3ae5d07b6171844322ee47ad4d904d530ebbcc54194f7005ade9249657804bfb

Analysis

max time kernel
150s
max time network
152s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
30-04-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08b0fbf32de4782ea4916af086640451_JaffaCakes118
Size

168KB
MD5

08b0fbf32de4782ea4916af086640451
SHA1

4625e151203f8cfbeec33a5cae35556f994220f5
SHA256

3ae5d07b6171844322ee47ad4d904d530ebbcc54194f7005ade9249657804bfb
SHA512

64cb22ac7e62057e53cc628164103b00d066d9fa74e96d33b9412b9653c8401311985f67645e9ceabdc4719ffddb08c872835b0082c37047065ff93301df2190
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Xmv6V0:5SeOQdaZNxtk8cqhSxvHY9Xu

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008af48-0.dat	family_evilquest
behavioral1/files/0x000000030008af48-6.dat	family_evilquest
behavioral1/files/0x000000030008af48-14.dat	family_evilquest
behavioral1/files/0x000000030008af48-20.dat	family_evilquest
behavioral1/files/0x000000030008af48-25.dat	family_evilquest
behavioral1/files/0x000000030008af48-30.dat	family_evilquest
behavioral1/files/0x000000030008af48-35.dat	family_evilquest
behavioral1/files/0x000000030008af48-40.dat	family_evilquest
behavioral1/files/0x000000030008af48-45.dat	family_evilquest
behavioral1/files/0x000000030008af48-50.dat	family_evilquest
behavioral1/files/0x000000030008af48-55.dat	family_evilquest
behavioral1/files/0x000000030008af48-60.dat	family_evilquest
behavioral1/files/0x000000030008af48-65.dat	family_evilquest
behavioral1/files/0x000000030008af48-74.dat	family_evilquest
behavioral1/files/0x000000030008af48-80.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 16 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/08b0fbf32de4782ea4916af086640451_JaffaCakes118\""
1⤵
PID:518

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/08b0fbf32de4782ea4916af086640451_JaffaCakes118\""
1⤵
PID:518

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/08b0fbf32de4782ea4916af086640451_JaffaCakes118
1⤵
PID:518
- /bin/zsh
  /bin/zsh -c /Users/run/08b0fbf32de4782ea4916af086640451_JaffaCakes118
  2⤵
  PID:520
- /Users/run/08b0fbf32de4782ea4916af086640451_JaffaCakes118
  /Users/run/08b0fbf32de4782ea4916af086640451_JaffaCakes118
  2⤵
  PID:520

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:527

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:527

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:529

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:529

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:531

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:531

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:532

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:532

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:532

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:533

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:533

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:533

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:534

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:534

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:534

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:535

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:535

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:535

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:536

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:536

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:536

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:537

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:537

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:537

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:538

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:538

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:560

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:563

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:570

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:570

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:571

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:571

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:572

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:573

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:574

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:576

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:577

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:578

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:580

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:580

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:582

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:583

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:585

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:585

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:588

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:588

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:592

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:592

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:593

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:593

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:595

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:597

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:597

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:599

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:599

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:601

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:602

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:602

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:611

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:611

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:613

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:613

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:615

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:615

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:617

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:619

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:620

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:620

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:621

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:621

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:622

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:622

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:623

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:623

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:623

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e50376455ccf294a9f85d6ea637c0c7e

SHA1
c616e6f0e89c3c8320eb349f2db8caf68f10cdc8

SHA256
5f87489454a569e56a0104d422cd95055e0d3220e3bf542e9a09f85da4f474e0

SHA512
1a5ce8cfadd48c4ec24cce2819dadb7ff5abbea142e9a2d64c2024557bd269191d669deb38888b14930deebb24659b55227076854715aeef5b7b63f6ad81e089

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
539a4b727ec35365384634d39e3a79f1

SHA1
577f4fa6f55834c23cb6eeea4b30594daecec7e4

SHA256
51b0a75071b0e7ec161cbd04181f7c0495cbb40e2276abb11cfbc3f5fc52328d

SHA512
577e1b4721239ae222a41e833d218603dbfa1124a75e9cd3daedd7180a12b957b285c5e749dd6f5f30b91e467ebc6541a9736e18dcf54ece10582009451de59c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0cdbac0c8a76811e72f108f51071a29a

SHA1
255b6356c8502428546c0227902ff2a6f8348614

SHA256
c3343aab1d9651aeec4e517d45e4bc38a034a194efc91d91b9ab6f6d1fedaf0a

SHA512
390574ccf8cbbd5af4fd14182dc22c9b6a4973323c24cb64c8e15bdbb7dcdb2df1dc0df938c2791a90c060854d30c81601dd267f298b9165119ec7ee5e579d30

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
56920cfcc00fbc2bd64efb66bf0dc7d0

SHA1
96f130a3d5e24abe19537e6d60f783fb406dc104

SHA256
e32fbf1bf5cb5691568f6f92964b740d21c82fd57c768d9c46f7647484565252

SHA512
e981f6a4614a60e199f3541f4f53e12404fbcc10d78f415f829fe3c041d6d1a57dd861e9dcfeca84eee9546fcd680691f54d83cd914cb39f1b780b05e585c029

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f1d9680c10e73b4b65cbffd48aa83fa8

SHA1
cc88d48b88742b3ef0f59410610686f30ad86ff2

SHA256
dec84db178205cc0dd30724876f1decae0ae871267f141cd9f56026f7ca17000

SHA512
e9f527cb7b8e631c59dc8a37d2c025ae2ae71ee8f74bf17193f6ccbce64eef264c3b5ae1e0e37502b99da7d98937f6bd4e6a67e87f44c23aed7532cc6830c362

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
48cf583eec2d20fe0cac96bbec41eb2c

SHA1
fcb83087de61f3431ab7ef61e666cd28c19b56d9

SHA256
c9d10061ff3ca4e764f07d92e60ea92bdad62dce44d64efa5acd93cb640ccc83

SHA512
cc3383f8c0b53d4923d1a30989d9c3a149a43260ae7a626bd1ae9ddf28ce4bae9659f55e20c740ad57c1f187b810ee041ce09755fced1afa73762877a165fa3a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2522219a952d9f421da4940937f480f5

SHA1
d8316890d049c90828b5868c46e9b239db3d38d3

SHA256
45e782d5c61dac7e1fb599a0d12f16b3941812ea66b1a322f939bb16b01d3c0a

SHA512
4cf96cdcf2f34987f850ea5c8d59b86830a46e990d844ca66ebe58d7ba0dd216e077f691a0863392db1fc6c42d88fd536f16c144a3c60a01f8660af55b3b47a2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2110889a64dad024126300387fafd893

SHA1
b5f94ad21893b9c6ca1379db4915909d50c224ee

SHA256
53a71458d58160c0d0d301f90981a1afcd7e4a5d2cefc30d8bb7cd5517761b0d

SHA512
66700931e1b0a183416d62cbd9adbbdd7a5c558e52b7e3f68741c18919bdfdee56c08d80198d2c35c295c6f1d63a182a83935e2026b4166cbd3c4fcc425ea4fe

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
46955939c894e0c09b987e4ed68d5b37

SHA1
3a43a1ae64715a881a544c4a13a595bd7bdde1d8

SHA256
aedb8f97b90b8a9a81a08432888b97d6a010b8d509aa0c1ec988f315a1a1c882

SHA512
294832649429da089e8fb0380cd80dc56bc68ad3771cb79064a77b617c5f8a3fc9a21b1412a6f364b19b7a495b14630a731de2f2ba0d0b015660b8b1e3e86c91

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9adc16013fd736bcd67ef0a179c26915

SHA1
ebbc1fff80498dd95b927e8dbf577b54d0a1cee1

SHA256
d9c6e57a456e905bd67b8ec8f395e6f4eef05ea298278fad306b2db5a58e9f20

SHA512
0b7b04b012f07726ec2d7cc944b9bf378151093c493328e303c9ad04fb9a544e14c1324d12d145f7e09ec003f34cbeb71319c968f170f6d89c96d774728f9f71

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fc19a0111729d5cbf03a7c133f2e64c2

SHA1
050db41e6787035069300b88be59f32ce17a33d2

SHA256
0207e3a9ff86bfdd0cd1c52f6b1c98c5c8999185718f7f0261a6a0b6e7786962

SHA512
e13d6ed20f0bf82c3e7ecc93d9616f1212b13a3d270c34cc446240da9559bad1fbe809293e707aca2e4592cc7b07d931cb4070c539dac1e4dcf908d7965e01d6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4a4c90be6f04f43afe0de68708bf98ce

SHA1
5a981198dc53bcd845ce1fba8f3eb7a0ed9157d8

SHA256
9831fc61aa535429d813d06c59bd4a04d117cd141be4a68d44747acba536e436

SHA512
f7a5d78ca4892d0554033c6ed29108ee986abdb295d12ab7e27ef1f4aa9cef937d76e361e7eef891f6dde6fb99d078e49f6260000d3f962c91b98bb4849937db

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5fba18abf427a1396e2693de37deb627

SHA1
b56e16ba71341c7b7fc72eae517ec47326246e8b

SHA256
9dd7ddab5e0255c5682d01fb98c7ec8496b7dcc05d6a83b6b9fe83a45b8094bd

SHA512
fb0c33e3557ef2bc5775d6b2d83732da43164ee425f9e4c2a7c0d4f3bdf9cf1cb9367b7853e419785bc46713ed318b9f499a7a2ed9c439cdcbb92897914e214c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b7062d72242d10207439459947f697b0

SHA1
8b5fb4009301a59d2bcb713597f5dd84ce7c342a

SHA256
3b61ebda1a9d3cb3caed3a3721dc245816604847771054ef1bc85c5be288d0a4

SHA512
963fc60a25ab5a794076ce049757bf60442e3aae1e841ee63c76cb8cacfa0735b66011f51b7a4a87dc6b23978f939f639d4f5c35de8b78337270c740c72562fd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1943a6d67f5669d9f420db85422713bb

SHA1
57b16ce5593d06842f395f8eac4126e6fa2a06fd

SHA256
ebbcb110ebe750daf043ca6b31b7903f87d8cb7e59798169c8661969bcd8f12a

SHA512
2ddcfe81097471914bd808e345f5ecc97723ddaed687ee8da5873d2b0da5b350e3b3db6f2ae9b5173306a8c1d552fb74ba8768c791fbebf79f10b6eb24b17460

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
288B

MD5
55d707d8a498ca399dd49c710374392d

SHA1
94956fb7af8ebb24faa018be5739179ae2e21dbb

SHA256
0de9ce482bde894cb5d5042cfeaf0d54cb0f56ad4852caa4d06ad54a53a7b49f

SHA512
e6183083a8f1f1ea5e67806ecbcab5adefc331aca2622e3b846cee48b803a91076dfd9a905573ee71c900bc5563b4e6e7f3ab994de7e29552a01647cd29ad20e

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
355B

MD5
a6ef4856e99c9d8e1d9bb762c5a8503a

SHA1
25d5405ad91791b716ae5a56b37aa2b393854967

SHA256
232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa

SHA512
582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
55d1fb67899b3cced13ab523e86460df

SHA1
242e5cd62c9c0c7b99bb73e39f3504bc133fbc86

SHA256
17d81de733ca53afdd2279ad2ddc4442cc6d7c80b83f7984230bb4be960865e8

SHA512
2fef4d404aabf2cfd844b9ecb2d65e79232a3beec407f30d32db5e19e124cf86f09bcd26b2442fd926b82fe6a9fb4baafdbaae366f709edaf5ecd53244d6e416

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
3c88ee32215fbd955288d06572f3ecea

SHA1
3f6aa0e8606666680833559b32657cf1263937dd

SHA256
1da147f4bc04ac4c7c549857b109048e996d301843f23f7aecffcc81808e47b2

SHA512
733520a6ed5feac9e8bbddeecd04e530b3a44106d679da7fdb27b63920a38da123c9238ac024ba49a03b3bc0360524386ee978519dc29ef7f27bebc9c18bd3c0

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
db83a482e27f5c06c1cb5d01c4bca9fa

SHA1
bf7b8840f2539c6ab27ae6652846efbfecd1fab1

SHA256
5219db075c06e214ffeb97a2e409473594151ba3ad1b9084503a376a3350a052

SHA512
c94b0a9b6b520c51b0f915f2559d4d66283ed607cd2db883193457e2494b617f41ff966b228f4c105d34ecdfcefb2e32178dcb9db6eff17d8efc7b3f8652515a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a8a485c883797f31ddeff3c035df4f40

SHA1
1d131a8d6ef729013f5d9edd081288ea2012ab82

SHA256
46cdddbe079d9ce0305afe50a281782b6592984f88a595a6fd9356f0817f1fcc

SHA512
9074dc026446c1fef50aa8e80e605b8899815bbedf1e5af55a9860c7b155c1d92c9142bd35c7061a3579a0506ef9307e7906bf2c51a86875c3538570dac333a1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b41799ee709832d36b299a654b9543ba

SHA1
5094de7bb7054e10da9b3af2b4955c087dde9c1c

SHA256
e491dc15dabc0212ac20ea6ac6b46a7b8be283df0cba47d8b2ddfaac42cf861f

SHA512
b70084bbbe09cdf1022e135711f057bfd9896d4f39c95239cfbf52f671aa5787243255073eb1378ea627fcf53c11d8324cb9124dccc0c0fd90d5c4bd551c30f5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b1b12468a12e20493bb743775e4843d3

SHA1
19368f7bf189ed29054c1e98211911bf3d18a837

SHA256
eafe7811418fea763050eecab83443a7346bc928e8bca79a5622cfbbee4a4b7b

SHA512
e1d43800af75d9b686a3f9f88eec759c35c2871b57238ad2caf1d49545b0ab1ad849b3d8cf335f3d3e8c05399834e59d4085266fc796e570aa8a38b3d63d1630

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a361cd2b45e5758f8a83f076de356c0e

SHA1
ca0bdbcf5e161dcf92f464534aedef65fe85c160

SHA256
9b2879d1a63addc9645f1bd0007b868bbef79c7c54f8dad028222464fe66c507

SHA512
719365cc85a75333ca206290d2c20c4c827d3a6084b5db93d15ce748e0af5cd7db9381b31259e2fdeee326e759df519a9ebb1612d39bb6a63c430d0116b637f7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
420fb4459c64194346ceeaae20538d92

SHA1
150166547d6272889ecd322709746031ddc28731

SHA256
f5b559f11a411359fb9f9dc2ddf77f02cb7787ca4ae1475a2c881e6480782b6c

SHA512
65b90e18c99bbd10083e1fd6832a91e352d23705294aa8c20e29d2058a01b166e3a8d9ad324ccdad437dad1e541e23b3cc71d5af780ad5e09882b169e5e33364

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
16e154968217a0b2418dbae2cb07370d

SHA1
c2ada74ff2835ea84630be5531f82bc1e5b9d47d

SHA256
24f0e9fe4e98ca26aa4af189cba7375ffab2e5cf0443dc933ad1eee6543704ed

SHA512
4b67cd649bba6a85f57bd975b7b6e14feacfe31847218e1bac780b9dad551319b9740588fd3e83799e76be13d6257063a0db5f10bb5e3a80481a5515655681f1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8383a56eb057663d3ac82d64b16e56ec

SHA1
e1238277f3b35c042f7726959e5c1e8bc6d27005

SHA256
fc095d4a92081dca6f459ea4947229c0c82847525c690a5765b46f03d1e4b8f8

SHA512
d5a3596ee17793841e75d4b8e70d1033cab81e4dce44b55ac1cd03c19fbc380ffab9f65305b1054892511803265b18b542d2273bfb3075ad7c9600728a40c780

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5085b4ae530fb4099c85ad20f361244e

SHA1
9fdba1529a33f6bc2b88d7c227b1a08c50cecedf

SHA256
601a943fd9e4531ea579d97777bae92aef46c2ae23d896847695a288c10a1185

SHA512
9155ed8302d21bb7eb567a565777a1c576b2433d5862ee9f61c7b19ee8c9e8545e3b10ed5360ac238145fc436090a21628e3edf8629f29ba8d25d465b92d048b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
de721908ce43b27fab926aa8756fdef3

SHA1
ef03cdc9b4432d701764346e8c48197ff8334385

SHA256
ca542f1ae9d7c3ed3478b3af58377743f8833f7ed5548e806c96e071558c7448

SHA512
92d6f60a84da6ec5940c5c892b5a90ff3393d7ace7b5939b703da35cd9a45c380ed5c728bfb02d6702190cd2bdc578c8ec99f385d982b6b343dc8d3a2c96c4ea

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
714a9ee940f034d777b32ac59aa883d5

SHA1
12b1528f18861062eb01796011baeb35d9553545

SHA256
cb49266c198072539c6a4db95c4ec18f713abd15e46c425fb04a63eefb0e2b5d

SHA512
543aa3055b0029b3bfa8bc0aef6035cb89d44554faba847eb5491100cb58aaefc6ec4e5489047c2d97d80f3e8a9c880c774a79c3c9091d5dd0d79fe817e7823c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ca8d3df72304881d4a6b5d6e5048717f

SHA1
3c75b7e916d4b524f885d7c0f2a53d5fa8248b6c

SHA256
35dde9bb24da77c36522a4853ce1bfeb196a29f0cf77b27a606470c650486ad0

SHA512
f041f7cf67cfeb3d33ea70b297648d9181a0e4a5d245fa85016d9e523432f5e20ad6014c70082685fa3e13dde663e6c3c9e170924ff8809c461bcaeb3a8641e4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ff08e5af08884c1e56c05a8592ba09d3

SHA1
6f2843f8e345dffe15ab7b0bc238a9279569a411

SHA256
dd34c3606732a80317da922bd3c6959f7b5bdb8acd82bb671c0dc79a6851d163

SHA512
d1e71ab6c9402ea9308055902b06822dca0af73955ba41ea7d880418164c31cff012964238f55d0b20133a17e9b3abca547837e6db63bbdd6c5a01582e54c35c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
899a260601dd992ce0a40c23f72991f3

SHA1
a0e7ff65d778396fb688d1525c54f218f10078da

SHA256
dab38d367d829412d497de989868dc2b4533a26cdf6794c291c6075b7535e708

SHA512
d7ecbb74725d39e3cdfb0731bc4956e8b706b2121123335e33727f3ba3733fcfbfd590039411ff3c569b69efdbc8b7e45e9cac4496d016860035dcb73531351a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
39208e71597cf7ca88d2f5957c3b78b1

SHA1
3fcfefa98abbadccaca0c6e224682555e235b0a0

SHA256
f8a93aa79e3160fd4405e8a9cf59e3203e7131db53ad90301ce3ac92639e9219

SHA512
e4e940bcdd9c901d85be165146032e8a48d5939ffe944e564313d9b4662e22419edb15d5d04e9240998cd42b8cbbf85528cfcabe87d684ff874626acd2935c85

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit