evilquest | 4259e483119b500e1f9a9b6a0b98de2fa528cae085b95d400eda689d620f58f8

Analysis

max time kernel
148s
max time network
141s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
03-05-2024 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f9d0e613d079f222503aacb383b66a9_JaffaCakes118
Size

168KB
MD5

0f9d0e613d079f222503aacb383b66a9
SHA1

c2bdc8a37a241351cdeb79260c1d228752d98327
SHA256

4259e483119b500e1f9a9b6a0b98de2fa528cae085b95d400eda689d620f58f8
SHA512

d39a670ab15bf1e20ed1f66585db66617b6c69a7ef61a6aa63e0e7d1bad668e3dc9b4b3dbf4e43a3b581fcb238c6ab0de750f878aaa33f6c98882ece126ba6e9
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9m0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008adba-0.dat	family_evilquest
behavioral1/files/0x000000030008adbc-1.dat	family_evilquest
behavioral1/files/0x000000030008adbc-9.dat	family_evilquest
behavioral1/files/0x000000030008adbc-15.dat	family_evilquest
behavioral1/files/0x000000030008adbc-19.dat	family_evilquest
behavioral1/files/0x000000030008adbc-24.dat	family_evilquest
behavioral1/files/0x000000030008adbc-29.dat	family_evilquest
behavioral1/files/0x000000030008adbc-34.dat	family_evilquest
behavioral1/files/0x000000030008adbc-39.dat	family_evilquest
behavioral1/files/0x000000030008adbc-44.dat	family_evilquest
behavioral1/files/0x000000030008adbc-49.dat	family_evilquest
behavioral1/files/0x000000030008adbc-55.dat	family_evilquest
behavioral1/files/0x000000030008adbc-59.dat	family_evilquest
behavioral1/files/0x000000030008adbc-64.dat	family_evilquest
behavioral1/files/0x000000030008adbc-69.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 10 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Launchctl 1 TTPs 20 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/0f9d0e613d079f222503aacb383b66a9_JaffaCakes118\""
1⤵
PID:487

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/0f9d0e613d079f222503aacb383b66a9_JaffaCakes118\""
1⤵
PID:487

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/0f9d0e613d079f222503aacb383b66a9_JaffaCakes118
1⤵
PID:487
- /bin/zsh
  /bin/zsh -c /Users/run/0f9d0e613d079f222503aacb383b66a9_JaffaCakes118
  2⤵
  PID:488
- /Users/run/0f9d0e613d079f222503aacb383b66a9_JaffaCakes118
  /Users/run/0f9d0e613d079f222503aacb383b66a9_JaffaCakes118
  2⤵
  PID:488

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:490

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:490

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:490

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:494

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterB516C108/OneDrive.app
1⤵
PID:495

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:510

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:510

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:512

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:512

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:513

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:513

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:514

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:514

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:515

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:515

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:515

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:516

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:516

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:516

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:518

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:518

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:518

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:520

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:520

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:520

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:522

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:522

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:522

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:523

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:523

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:523

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:526

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:526

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:526

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:529

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:529

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:532

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:533

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:535

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:535

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:543

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:543

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:544

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:544

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:546

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:546

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:547

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:547

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:552

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:552

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:553

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:553

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:555

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:555

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:556

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:556

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:559

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:559

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:560

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:560

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:561

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:561

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:562

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:562

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:563

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:568

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:569

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:569

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:570

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:570

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:571

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:571

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:572

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:572

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:573

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:573

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:575

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:575

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:577

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:577

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:578

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:578

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:579

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:579

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:580

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:580

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:581

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:581

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:582

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:582

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:582

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0f67824fcbda4cccadb8feb7632174d6

SHA1
f19e221705118439ce3b9c531535009f8c0607a3

SHA256
d5267d6ecd197c016ba05d7eabed28e1a0dfa0f01c869b7f62bd066b5132afa5

SHA512
4752466e0e03c40cfc9f4a4a99c68531b3610d755a1590240dc75fd8dc9ea985173afefe7ce852494141748a02cd6eaa1df066205778277430edd85731cae2c4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f5a86b6cab5c9cb3bfad66a60a0d2132

SHA1
df3906a912e5500fabfd4cb0ae945d02b031eb72

SHA256
1662840f2557fed63a28ddece256f6a829ef4321c51606cbc2275964d182a4c1

SHA512
712a1d0c36d13ce1f9fb1f7b3959f60510c0bca7c8ff8e773d3b2f5fe47e36b484e45fe0a0fc86f56f9f40f668995824155497741b659ad66164215c7f180d4f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
41ad659fb908c1798a378ccdf8f37a4d

SHA1
4c0aaacba8eda106a8cb40fd918e0e763927d938

SHA256
e1d6bd53af8695f0ec63d25f351daa3a351354bc2d8e780c11ae199c6380a80f

SHA512
e2f8fa794c8f2f0225245db75b5b51dd8a18bb5f3829d5c05952617d3612bf2ba956610880380f3d6227b5688cfcff90b1f17624ce6a00eacd86b5c6acb3b059

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d4d3d164fffd53ea9be226099c955181

SHA1
4e51a43a40569a7b40775b9b5d5c91974ef1a329

SHA256
1d34b9b3a56f878530ab40635ddcec28f2717d6acd109971b5b70eaf1f6f2e9b

SHA512
b4a74393587aec24c0a13317daef49135451f4906b0f2cf55488dec59c9d76c5f6977f6d8fea189b694cc816ebd64226d7c7a653a06303d2d5cf9851eab9df30

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
085fbb8daa4170e147223a81384d2e4d

SHA1
7d7df97469a9c7294eb25f046f0124e491849fea

SHA256
a1fec9d6933e2e9ccd8fd183ae4a301513244e756ceb703c2f1741bd149a42b4

SHA512
0112549bf2996810aaf322a72671fd113746501ae4fe94defeee264a940a576fc0ce72cf0c10389a75dcc418e096f175177d8b70a910dd7e482b576beb3b38cf

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
eb67470fa071535526e2170b2e7bcf51

SHA1
d61d6a7ec9a3475c3b64981912e7dbdc476b4468

SHA256
078816689ae6b92c16ac98bb00e9c3412e3492e939c48d7fa07c87fbdb8932e1

SHA512
7b449461d74be68b0c8f130b6b5ba46ed860adb91a4b6d1efbf5b6ca0069e6c9803ee1ed5cd36998832eb1ba390a209acee5187dccd31fe07017e8f20255c0b4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a9108e869bc07a6d0ca5d62fe1311f10

SHA1
c66ec7cd795c89b0adf88eb6f04c2302e68d3311

SHA256
1ebb9abe227069da7e8e1c43cff0f5b01e7e75d8bcd89cf68bf23865a704fcf6

SHA512
1f4b0fd66d272bf9d10bf95f9edbf8741799696fb7bf6c868e757509fbf72895b4eb78615aae939796b158879b278e7e62268d0422fbb9ab4bfc5cb9a71d4316

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5307e2dad731654dd64b02b7a2fa0c7f

SHA1
3dbd96c15b1473cad5a21221507e3299683db60d

SHA256
b188be74ef6264224d13111531f696f2529c8ab4b3e893050229146fe33e0889

SHA512
9f00d0f5a3c375a6b7cc90baf6514bfd6d64554b040561fc6068684c98850e92c4bdc370471e9c53937a35891cc8624e819231677f98830cdc26536eb0555690

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ae3370b6fb430101202d4e33907e195c

SHA1
64fc1ff8d3ca6b5fc6f64ce5b5c7614fd9ca81ae

SHA256
d64b48533c9f26c74ede3815713dfba58beabbdc3f59715571ed5f97f24a2fa5

SHA512
8a4ef9f9896b93669cb3c83592ca88340d2c79634a52a3963e749cc37110f5d66b824ef0842fd81b65abeb9cd14e4285e10633de0e5a737be2ff61ccc5cdb5d6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
82ee18de42def38df551c7fff31426f0

SHA1
4bde244d5fedb34f0019f78708f8ddfda6bd7068

SHA256
e2e8792c77e4faa59c645f0ca3e5ba7ca5e20a0a87c3fd6ed636320af0e20254

SHA512
01da2177316b7acbae54132788ceb50b1c1d688fdd4a0010d52a1839b57ed3ebb6def6d0b908893abe2aa4e4c2a3d6b8ad2f7fade0b38d04b971623480d73858

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
133e7ba28394274348321b9f3d685d52

SHA1
926c65a549c300a3d3e97ec583a9fa66511a6e09

SHA256
69cdf67f2830b02bed282a0b3a4e531ee6481b9c09b69d6bcef0dcf7bdcbe003

SHA512
599be6ce6ee43c18c4b293ab19067f28c21828b28d21df0ff38aa64dfb49defdf2a4794413edccbd2077bb8eaa068a567a51c91a751a1b9271c5d0de7936c1af

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
296d002e91ad8412accd691e84786e04

SHA1
dfc151dea926434ce482f169789c6b3ef5f2ae7c

SHA256
29fc6e639dcb85fd5b37b0c27ea1d3412073fb9a7d964760fa632f9d14545003

SHA512
bc1e22ce356b85340f0e2d1c2b399da5a232a3c8be46a18e3387e1e9a2337d69a30196a871b85773672776b3da90911bc82a4fc9a47e4227016f4ee6b43e51e3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
62b19963927934aa778a9f84e18d6fa9

SHA1
3f4e532a956c71737851349248d403a569088679

SHA256
735816fb8884d09086139022af5b86334c64452700c4253258771a1c5e14776e

SHA512
9c2a898a2b074962886a4f110088d1136acf3f65ebb6334d4aa9c3af25533a9b464c48855d64988e4986a2cb2e1ce1f7edbda041b5f43951e562afc23119e96f

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
bae69a825e90940047a0de0f2d8ebccb

SHA1
5ab00a948660c754a0ed77a4817b46816cc17092

SHA256
b20d7a78811da2c209a5b41a6f6cd40f6f9fd69f5e3a6077687f6063cba5b90d

SHA512
c5c3d5d30d169e4670389dc6e3ffa1535015af66aba1635ae669f192c3acede9770ba64097cc05cc708e7b53d8ba298156a3d702dbc62e0e20ef7627490ee792

Download Submit
/Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
430B

MD5
3d269391b44f568c96f9f5a420609082

SHA1
e2d49405da7ba6f883b366f71b6905b6ab556cae

SHA256
261e6af4aec0840afe0b4c75c21353d7bc8d69ffb1d26db364f5475962381a12

SHA512
81ae24faac0d2973a90b7ec7415273f95789fbbdeae164df6ffab10bfdfc4896d6ecf4d9b09ca13b2a151a385c59f48594d7b3d0df3b49e3bbc056f15908432c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
090c31829c91dc7ba6ddb5524f38d6b2

SHA1
7c2af7fb83c87b1d5b462409f93fc180961179dd

SHA256
712b64b4d247e54f3a4074d574aafc1e063b2a896399a7d27dc669201f62e97f

SHA512
5f9d9fd7ba57193e243ccd16d763807effc5b87f9f2c02f71e1c6c4cff908eba11fd2367f283b12f52db52d43724c16f71511ffb99d7440b60c1666307bea222

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
63fad732499354d58a9dc4bd8a8e77fe

SHA1
400b932751a3cf4bd0e5732624f23480ae12e811

SHA256
7f607e0fdbc89d4d1c45073b1aceb70456c8a54e42f373f65ae6fd6b86dbe91b

SHA512
0a2391be295bfa7c3e2e16312143255f3a91a42003a657ff92c5791c69156fc36bf52cb299b4cbadc28ccd5e1d484ba8267f87444cfedb9736c17e3ff4882179

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
759fbfc5c5c0aa89cca14f6caef54223

SHA1
8ec69f26e0b30a734e4119cda56a280ca2854caf

SHA256
0af1c80ce0cbe97f6d998fcaae6bec1170a58cd33f8934d56bee1d26a51e9670

SHA512
4f30fb1c3baf548001796a3bbaf5bca1fc463d55da9de6d95ff2b181b62a8d08f92f9ad23f1bed1f114d7fa3071386169eac2564769a4645c9fdbfa91dcf96be

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5ae1fc3d1be2566aa807c2ffaae152af

SHA1
6ac78d6ff36c0e890b633906af912fab8a31d657

SHA256
40c473faa1d0c0885cd5d088b05e41aff72fc6d87059e8e3229d424544d63f7f

SHA512
4624b32790e92ad6f8fd3ddb6dec43599d2c2ecd48e9ae5339bed0a1ef2bd329fc4e8925b1c1ed0f462e3821f1df0005514e64bb7ab000933c5c2486b422f0a5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9bc4e8a8c3e621fef5300bea4fdcc401

SHA1
c4db513c67bc21ac935b6c9bed545ed08db2db6b

SHA256
80bb0225aa856504434bf610940984848972067b7fdab1475003ff0ff6ce1ec4

SHA512
b488adafa5eef4963a8597d55a0cbd73ab60ed5da819a5452a4c04157172935c1dbc8209efe393e266baae26b71b26aa6b38f58b97a631b13c9b4a1a9ca9c856

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0ea9201417abbba1cd9fca218d34cd30

SHA1
7deefd7c0bca5716b76154f10b2bb4e615ee1e5c

SHA256
38930a1bcd83fdaac93896c66f11d6b50d558d668f9ca2283dd404c2394fdd00

SHA512
7b49f3d837d39ff863594db7f37655b02e59452011ffb5ee32be03086de3ce01ab0eb1f9557732c0032fd834f78ba63d78c1eb3b0a7d50871bd5b00c601bb1da

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f2c11ca1db215bb43e32e612d08f9fcd

SHA1
e81d738a05a55f10dc9a0873eb8605377d2eb7fc

SHA256
af964c83204c6f631da17359abbe36172640ae750fb3ffa437f34a571a773811

SHA512
2295bf020db0ac345a80f51bafa67ab2354964bddd029be9bc43348911e8c5262a5af9bbd065f8345ded5f6a3efdcb32c18d5ede6ea9a04a7aba0cbf19eb244a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
47b74eef3d9c9b2b97fde87e88292980

SHA1
f3534070bdfc6f27ca8999dd8e66e789d3175a7d

SHA256
3272877f71f523af7d50404a6a42f623d274c1b2d6e48c043d055df786e6e116

SHA512
f53096f54132b39b6df0ee60e15b0dee220d4ca50c0ad8530e9c96f708c7d64d52a20421465b995ca8606577a4e2611eb781fccdee5f484a989b6ba73a38bb7b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5d2e4616abb59f04d6651d4a7330401d

SHA1
75394f38b6995edb07e2fcbf0ee23d34169c04c9

SHA256
477fe2ffe364914458d4b2f515a7b57a43b98dfb66d52bb668b5e74cc0c5595f

SHA512
535f9e8fd89f01e79312d7146797d1a96521da0d3353b9c69f8efcdb442856bf9c91407c96503f4bdcb2fc51203bbba97eca6c80356297f21196b75ce6c5469e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
bad7b44bcd8786819229d57c0df7b615

SHA1
2b69d222764b55506a955b6a122d4e9057df01a4

SHA256
fb94bc8f8fc221164b3243e568d18215438bcd22b3b695df680fc9fd0947051a

SHA512
229b860d61d05ae613f70012fea6883d49e73eade44c27a4f31b5b586e3beed3204d5bfcb0c43becd039c1ebaa963437c4f6c3eba0e418b7a6fb6a3ea42cca90

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a9e6168e070f9ea474233910962f3343

SHA1
9a22aa78d7202e3ee3c586a8a3a257255ec55cea

SHA256
df056d65969998372ffacfe4ead8a7db3f9b5abf4304504130c61d6721125abf

SHA512
b355964d31bb29c46cf589ab9813578ca0e216ef0af57ee187c3e90aacb8788038ff1bd8b355d15fdd6207b84759c25232a4b61c96d1bdf78b349f3382228c3a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
923f5f60ddec94d94e8898ae0467ad72

SHA1
fef14584022c557cc459b66d101a0642cb78dd8c

SHA256
a739777f8fd778f69001d0a653eb182fdfa5295f274a1f852b365c8b92d19576

SHA512
ff8cafed9306d2c396f651e9edbdc7160d62cdec9a17a45174bc7e9e0aff37875b222c500c68202f7a06957c778de63f001a1e3e7000749f20fd6c47c316f7f2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e758b1e479f7e8d7324023ac55ffb093

SHA1
380e2b42738183a627a7bd23a9d2fa1545bfbfe6

SHA256
76bb3e1338c2e2c0d8d556dec75763ef68cf67d86a1d0e1261bd1fd6b6ca08cd

SHA512
eedd8006b954567a7050298f93929c5647caa59797bd1c8c5021d4c461f7604dc00687e33f7853aa17b9c81313b0e0db7eb04cc6ef44985c4c9528ec54479239

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
32761ebdb3cbfaca7887d95650468789

SHA1
cf904f3ee60ccc4ad5bd2d9a00146376033664a3

SHA256
bc01a47689e1fa4a0e1abadf3e40f373b9416b5fd92e9daeeb3f516b729bfe3a

SHA512
428c62988c0a26e8f70c744e4d2185fa73e898177537057831c55b89ef31d30c69bd13f2a87ebf5ad1d5ed17bb717a8378cbf12a72726db45cd487c4ae7a64e7

Download Submit