3187e1b41839328d3f3497e2e5e02edd8b63a9af812b0e53ca4959ecaad8fdb1

Resubmissions

07/05/2024, 06:48

240507-hkshlsde4y

07/05/2024, 06:45

07/05/2024, 06:44

07/05/2024, 06:44

07/05/2024, 06:44

07/05/2024, 06:43

07/05/2024, 06:41

Analysis

max time kernel
112s
max time network
107s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
07/05/2024, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Undertale.app.zip
Size 3KB
Sample240507-hft6msgc76
SHA256 3187e1b41839328d3f3497e2e5e02edd8b63a9af812b0e53ca4959ecaad8fdb1
MD5 119dd2698b82e5c16ad74c0259e5a1ea
SHA1 24cb87f6b403d145f6eac23a0e6ffb52d92dbc9a
SHA512 728ab7e3f00b7798d4a2328ce5507e9cc0714bbba512a7b5e15b88ef70713e264803e7326b6d7a94a08efac9471ee5f9196b68826d901f1559394cb3b9ca07ee
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Undertale.app.zip\""
1⤵
PID:485

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Undertale.app.zip\""
1⤵
PID:485

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Undertale.app.zip
1⤵
PID:485
- /bin/zsh
  /bin/zsh -c /Users/run/Undertale.app.zip
  2⤵
  PID:486
- /Users/run/Undertale.app.zip
  /Users/run/Undertale.app.zip
  2⤵
  PID:486

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:490

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0BF23177/OneDrive.app
1⤵
PID:491

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:514

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:515

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.D831AB53-CD58-44E0-9605-9595CF1ED97B 514
1⤵
PID:516

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:521

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.320A2E57-6F86-4D03-BE02-17743030A6A0 514
1⤵
PID:522

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 514
1⤵
PID:523

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:534

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.C45CD9B6-3CD6-45A9-9021-E49A41CF7789 514
1⤵
PID:535

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.87A2F209-F446-4A2C-979B-8339B391D39B 514
1⤵
PID:539

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.5815DFDD-6E40-4E5D-BA59-8999F06B6835 514
1⤵
PID:544

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:545

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.SandboxHelper 539
1⤵
PID:546

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:547

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.437552B4-C93E-4A70-8ACB-7DD414C044ED 514
1⤵
PID:549

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:551

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:556

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:557

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:558

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:559

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:559

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

997BFDC4C3D9A0E4C84AF66E829E4775

Path /Users/run/Library/Safari/Favicon Cache/favicons/997BFDC4C3D9A0E4C84AF66E829E4775
Size 5KB
SHA256 12e3d4a6a6e95a1adc67fe3e7ae0d6142372427c5d41df058dfedda140f8b723
MD5 c76da8211b0bb74d24d240544f590873
SHA1 ae95b33a1c8b97bd023eea20d38b93138a39ca4f
SHA512 d1fe04aea955e35572a1ed5995cb28afc9017f385b0de2d5f0a6aa276f433cbadc7b7a52cdce131983db5bfd3a6aff6283df54a53a54a9be4f45323ef706ccf3
SSDEEP 48:yr80Mqt1yUy+bYHVi3apjd7sKwuDDKzRDw2eCZ8:+8gyVOYHgUjdeuDWzRDw2eC+
MD5 SHA1 SHA512 SSDEEP

Submit Download

B90A8F6E86034E693942B441AECBBDF5

Path /Users/run/Library/Safari/Favicon Cache/favicons/B90A8F6E86034E693942B441AECBBDF5
Size 21KB
SHA256 5493c61cf725cf3a1d63cd9d07de75b0d6faa5564e772f7d0a6074f341442938
MD5 38cfdb248210ffd12a6e774119609de8
SHA1 d10a44e5d06c8a95e4c61ae770cc8f0c8d372253
SHA512 7d0ae6125e5c10d52847ac10e5200f2aaa84932ea5d10af54440c0abc27af19285cb760f0e8dad0bac4371e4b384ffaddcf235f9f1ba29e6dc41ef29deac4fba
SSDEEP 192:3SNhk9DWGfbC+fNLAPweTmK4bJwZDIWYVAnTUDLLWK3BlZ:NWGfdfNTFYILP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

EB463A87507A90284D66EB7D8A19CF3F

Path /Users/run/Library/Safari/Favicon Cache/favicons/EB463A87507A90284D66EB7D8A19CF3F
Size 104KB
SHA256 4172fa160efaccf8726ce46fe6eea79da2d77ff1978848b06f663a80c53f786f
MD5 3fb315ef4774bf9d76ff10254829a29c
SHA1 2dc02161b4e1f781d942dd5b5407743c7ef38373
SHA512 5bb21677b59b52b5580e720a3fa45cf19bdcab46ebeb2b5f3061ad3f92c62b758e41dbfa61c88e124a0afe86201a6af03151ea81368c42884c91cab6f9348a74
SSDEEP 384:v/IRDwtv1BlJR7f1PJUEEeHs3uac2NIJNpNFghLSuLg6kF8w0VB:3EctvPZVWDZ5iShL55Y8ws
MD5 SHA1 SHA512 SSDEEP

Submit Download

FEE90BAFE66DB49E59FD743DC9AD9D5A

Path /Users/run/Library/Safari/Favicon Cache/favicons/FEE90BAFE66DB49E59FD743DC9AD9D5A
Size 14KB
SHA256 95c427fa3143b1896faf42a6406686ce7602cb39052081bb32d12b51c9e047e4
MD5 def00c11b1596db4efee6a9fbe64fc27
SHA1 bd298981e6d8d7e4ffa18abcf687041f4246672d
SHA512 c056e95dbfa1aab3a50dff18c6d577dbffea72c93316ffc53b6b7aa41dcc7707a810d563894589a7305de0b76610f88150b2034670de368773b2b356f14ad30f
SSDEEP 192:jiHSINqv0tJ30DezSfPAXTZwC3D2N2xp1Fd/ar/+zi3LHZNwkQH0iWpXDt3TN8rB:jzAnP9j
MD5 SHA1 SHA512 SSDEEP

Submit Download

malware,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Size 220KB
SHA256 49995cf32a07089be077f879276896dba67decf6bafbed36d7c9e24193313f9e
MD5 3fdf4a150574ec67b597a3509b66285d
SHA1 fe889ef48d5ec9ae48fe1886cac666b88ed1d9f3
SHA512 1ba8a6608c40f89a2f26a9e77b357d86900deee8dcdcdf456863e0572f44a7520f250e4b85d9fed6a408de4c30e10a512c4f10b0f11cf7db1b3582df93b89da0
SSDEEP 6144:tPPOPFkaq/+gADfdTaO/6mBImwFhC5zdp:t+PF+GFjpn6O8Sv
MD5 SHA1 SHA512 SSDEEP

Submit Download

social_engineering,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Size 22.2MB
SHA256 07dd224704f3555699e793e6c1895c4fd216a3bde3fde7c4bba5562947715909
MD5 da0c754e0f7f5d5361d91805c1246c4d
SHA1 438194ead42ab0e2ce3c40bdbd289a4ad5c584c9
SHA512 193d8c6f9632913230932c6156fd2bd389fcdcb6a647af29c32a54e53be524526d1c66612f193180248778c1259ba1d5b41c5dc5597d458e8c93a6dc7eff35c3
SSDEEP 393216:EARge5FdoADnmXVGFEe9WKNYZ2H5iQzA9kYa17f5yFhNMbEQX3x2ZIbTnMTDe2:ZvUADmXV2Ee0F4jksf5yFEbEqPnCDB
MD5 SHA1 SHA512 SSDEEP

Submit Download

unwanted_software,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Size 126KB
SHA256 ea0570a367cef46a1108fe2a7bee492dcb24642699bbe95ced7f551cf00107c8
MD5 75a5146f524a0df941ad68ba51b0aef1
SHA1 8c15fffc455985cf932013038ab137159c633238
SHA512 aeb3456769299511de539fdb5ab58ee659e82ca91a4e991c5bbf46247b04c44d49e7ad929b0c5edf1a410682d3891f6398ebfb0c4acd8659209bc1fb957b61d0
SSDEEP 3072:hgdAbqpw7qqMxhlBfeyluXpt2a/JiDtatGhMFhpBnNmQJZW:hrqLToyluXpka/M2FhFW
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads