Overview

overview

4

Static

static

1

boyf cat.jpg

macos-10.15-amd64

Resubmissions

05/05/2024, 11:48

240505-nyvg1scd37 4

Analysis

  • max time kernel
    90s
  • max time network
    91s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    05/05/2024, 11:48

Sharing

Copy URL Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    boyf cat.jpg

  • Size

    87KB

  • MD5

    a355316bb95f88800e1f8b66c8b552ab

  • SHA1

    341c3bd933ae7251329b750aace9d1d14aa7e895

  • SHA256

    6e9c0007da07fd73d484124ff0801a93eaeb89ee5ade70f28e86f6d71263997a

  • SHA512

    590693f3a4a8809e1260546b383068e8cc634432da936c5d52a836daf06043eb75dc4c8a7a6306947ac539400c873ff7ba9e54e39d3db3e839e0fd0d09532d01

  • SSDEEP

    1536:sicLrvnSudH2PHfiSIUzGJ38Cb+fC1IEpscygtU/t4L4FxZHlpgkpyX5a0ZZG:Zcq6H2Sso38RfKdpvy1UkWayZG

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/boyf cat.jpg\""
    1⤵
      PID:479
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/boyf cat.jpg\""
      1⤵
        PID:479
      • /usr/bin/sudo
        sudo /bin/zsh -c "/Users/run/boyf cat.jpg"
        1⤵
          PID:479
          • /bin/zsh
            /bin/zsh -c "/Users/run/boyf cat.jpg"
            2⤵
              PID:482
            • /Users/run/boyf
              /Users/run/boyf cat.jpg
              2⤵
                PID:482
            • /usr/libexec/xpcproxy
              xpcproxy com.oracle.java.Java-Updater
              1⤵
                PID:480
              • /usr/libexec/xpcproxy
                xpcproxy com.apple.gkreport
                1⤵
                  PID:481
                • /usr/libexec/gkreport
                  /usr/libexec/gkreport
                  1⤵
                    PID:481
                  • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                    "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                    1⤵
                      PID:480
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.systemstats.daily
                      1⤵
                        PID:484
                      • /usr/libexec/xpcproxy
                        xpcproxy com.apple.PackageKit.InstallStatus
                        1⤵
                          PID:522
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.warmd_agent
                          1⤵
                            PID:523
                          • /System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
                            "/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
                            1⤵
                              PID:522
                            • /usr/libexec/warmd_agent
                              /usr/libexec/warmd_agent
                              1⤵
                                PID:523
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.rtcreportingd
                                1⤵
                                  PID:530
                                • /usr/libexec/rtcreportingd
                                  /usr/libexec/rtcreportingd
                                  1⤵
                                    PID:530
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.sessionlogoutd
                                    1⤵
                                      PID:531
                                    • /System/Library/CoreServices/sessionlogoutd
                                      /System/Library/CoreServices/sessionlogoutd
                                      1⤵
                                        PID:531
                                      • /sbin/shutdown
                                        /sbin/shutdown -r now
                                        1⤵
                                          PID:1.8446744073709552e+19
                                        • /bin/sh
                                          sh -c "/usr/bin/wall -n"
                                          1⤵
                                            PID:533
                                          • /bin/bash
                                            sh -c "/usr/bin/wall -n"
                                            1⤵
                                              PID:533
                                            • /usr/bin/wall
                                              /usr/bin/wall -n
                                              1⤵
                                                PID:533
                                              • /System/Library/Extensions/IOGraphicsFamily.kext/iogdiagnose
                                                iogdiagnose -b /var/log/displaypolicy/iogdiagnose-last.bin
                                                1⤵
                                                  PID:4.784951e+07
                                                • /usr/sbin/spindump
                                                  spindump -shutdownstall 2 -timelimit 5
                                                  1⤵
                                                    PID:535
                                                  • /bin/sh
                                                    sh -c /usr/sbin/kextstat
                                                    1⤵
                                                      PID:536
                                                    • /bin/bash
                                                      sh -c /usr/sbin/kextstat
                                                      1⤵
                                                        PID:536
                                                      • /usr/sbin/kextstat
                                                        /usr/sbin/kextstat
                                                        1⤵
                                                          PID:536
                                                        • /bin/bash
                                                          bash /private/var/install/shutdown_installer_tasks
                                                          1⤵
                                                            PID:537
                                                          • /bin/bash
                                                            bash /private/var/install/deferred_install
                                                            1⤵
                                                              PID:538

                                                            Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
                                                                    Filesize

                                                                    140KB

                                                                    MD5

                                                                    b853bf546d48f0d1c65b1ae92d79e1d1

                                                                    SHA1

                                                                    c47b637c178be927c204c6251134cc35f1e901a6

                                                                    SHA256

                                                                    5496e107f6a8a24dae71499805b927fea46f826074cd4d7b410964decc159f47

                                                                    SHA512

                                                                    cc98c699285369f0b8d465c89c71d2dec9a955e2f59183b45d53a1f3873026e0343f99eca06e97bfca8d71d5f9ede2e70569897d5ac1c5e94984116530bd513a

                                                                    Download Submit